Incentive Compatible Allocation and Exchange of Discrete Resources

Incentive Compatible Allocation and Exchange of

Discrete Resources⇤

Marek Pycia† M. Utku Ünver‡ UCLA Boston College

This Draft: February 2014

Abstract Allocation and exchange of discrete resources such as kidneys, school seats, and many other resources for which agents have single-unit demand is conducted via direct mechanisms without monetary transfers. Incentive compatibility and efficiency are primary concerns in designing such mechanisms. We show that a mechanism is individually strategy-proof and always selects the efficient outcome with respect to some Arrovian social welfare function if and only if the mechanism is group strategy-proof and Pareto efficient. We construct the full class of these mechanisms and show that each of them can be implemented by endowing agents with control rights over resources. This new class, which we call trading cycles, contains new mechanisms as well as known mechanisms such as top trading cycles, serial dictatorships, and hierarchical exchange. We illustrate how one can use our construction to show what can and what cannot be achieved in a variety of allocation and exchange problems, and we provide an example in which the new trading-cycles mechanisms strictly Lorenz dominate all previously known mechanisms. Keywords: Individual strategy-proofness, group strategy-proofness, Pareto efficiency, Arrovian preference aggregation, matching, no-transfer allocation and exchange, single-unit demand. JEL classification: C78, D78

⇤We thank numerous seminar and conference participants as well as Andrew Atkeson, Sophie Bade, Salvador Barbera, Haluk Ergin, Manolis Galenianos, Ed Green, Matthew Jackson, Philippe Jehiel, Onur Kesten, Fuhito Kojima, Sang-Mok Lee, Vikram Manjunath, Szilvia Pápai, Martine Quinzii, Al Roth, Andrzej Skrzypacz, Tayfun Sönmez, William Thomson, Özgür Yılmaz, William Zame, and three anonymous referees for comments. Kenny Mirkin, Kyle Woodward, and Simpson Zhang provided excellent research assistance. Ünver gratefully acknowledges the research support of the Microsoft Research Lab in New England. †UCLA, Department of Economics, 8283 Bunche Hall, Los Angeles, CA 90095. ‡Boston College, Department of Economics, 140 Commonwealth Ave., Chestnut Hill, MA 02467.

1 1Introduction

Microeconomic theory has informed the design of many markets and other institutions. Re- cently, many new mechanisms have been proposed to allocate resources in environments in which agents have single-unit demands and transfers are not used, or are prohibited. These environments include: allocation and exchange of transplant organs, such as kidneys (cf. Roth, Sönmez, and Ünver, 2004); allocation of school seats in Boston, New York City, Chicago, and San Francisco (cf. Abdulkadiroğlu and Sönmez, 2003); and allocation of dormitory rooms at US colleges (cf. Abdulkadiroğlu and Sönmez, 1999). The central concerns in the development of allocation mechanisms are incentives and efficiency.1 We study two incentive compatibility requirements, individual strategy-proofness and group strategy-proofness, and two efficiency requirements, Pareto efficiency and efficiency with respect to an Arrovian social welfare function (Arrovian efficiency). We show that three among four possible combinations of these requirements are equivalent: a direct mechanism is individually strategy-proof and Arrovian efficient if and only if it it is group strategy-proof and Pareto efficient, and also, if and only if it is group strategy-proof and Arrovian efficient. We construct the full class of these mechanisms and analyze the implications of our characterization, as well as the usefulness of the newly constructed mechanisms. The restriction to direct mechanisms is justified by the revelation principle.2 Before describing our results and their implications, let us highlight the common features of the standard model we are studying and of the above-mentioned market design problems. There is a finite group of agents, each of whom would like to consume a single indivisible object to which we sometimes refer to as a “house,” using the terminology coined by Shapley and Scarf (1974). We allow objects that are the agents’ common endowment as well as objects that are privately owned. Agents have strict preferences over the objects, and are indifferent about what objects are allocated to other agents. The outcome of the problem is amatchingofagentsandobjects. We study two incentive-compatibility concepts, and two efficiency criteria. A mechanism is individually strategy-proof if no agent can benefit by reporting a non-truthful preference ranking. A mechanism is group strategy-proof if no group of agents can jointly manipulate

1Incentives and efficiency are also central to the theory of allocation mechanisms. For instance, Bogolo- mania and Moulin (2004) discuss “a recent flurry of papers on the deterministic assignment of indivisible goods” and state that “the central question of that literature is to characterize the set of efficient and incentive compatible (strategy-proof) assignment mechanisms.” The prior theoretical literature on single- unit-demand allocation without transfers has focused on characterizing mechanisms that are strategy-proof and efficient alongside other properties (see below for examples of such characterizations). In contrast, our characterization of strategy-proofness and efficiency does not rely on additional assumptions. 2See Appendix A for a discussion of the revelation principle in our context.

2 their reports so that all of them weakly benefit from this manipulation, while at least one in the group strictly benefits. Importantly, strategy-proof mechanisms are immune to manipulation regardless of the information the agents’ possess. As importantly, in our setting group strategy-proofness is equivalent to the lack of manipulation opportunities for groups of two agents. This makes group strategy-proofness a desirable property of mechanisms in our setting, particularly because in applications we see attempts at strategic coordination. Co- ordinated reporting to a mechanism has been, for instance, documented in kidney allocation and exchange (cf. Sönmez and Ünver, 2010; Ashlagi and Roth, 2011) and in school choice (Pathak and Sönmez, 2008).3 Furthermore, coordinated reporting is effectively the only way agroupofagentscanmanipulateallocationsinmanyoftheseenvironments;forinstance, without an approval from the school district, two parents cannot trade school admission decisions ex post.4 The first efficiency criterion we study is Pareto efficiency. A mechanism is Pareto efficient if, for all preference profiles, the resulting matching is not Pareto dominated by any other matching; a matching Pareto dominates another if all agents weakly prefer the former to the latter, and some agent’s preference is strict. The second efficiency criterion we study requires the efficient matching to be the maximum of a social ranking of matchings, in line with Bergson (1938), Samuelson (1947), and Arrow’s (1963) reformulation of welfare economics.5 To formulate this more demanding efficiency criterion, we define a social welfare function (SWF) to be a mapping from profiles of agents’ preferences over matchings to partial strict orderings of matchings. We allow partial orderings—such as Pareto dominance—and derive results for complete orderings as corollaries.6 We require that each SWF satisfies the Pareto

3In kidney exchange, transplant centers occasionally try to first conduct kidney exchanges using their internal patient-donor pool, and list their patients and donors in outside exchange programs only if they fail to find a suitable match, thus hindering the efficiency of regional exchange systems (cf. Sönmez and Ünver, 2010; Ashlagi and Roth, 2011). Also, a doctor acting on behalf of several patients can coordinate their reports if it benefits his or her patients. There are known cases of doctors gaming medical systems for the benefit of their patients. For instance, in 2003 two Chicago hospitals settled a Federal lawsuit alleging that some patients had been fraudulently certified as sicker than they were to move them up on the liver transplant queue (Warmbir, 2003). In school choice, Pathak and Sönmez (2008) describe strategic cooperation among parents, e.g. among the members of the West Side Parent Group in Boston. 4Non-manipulability is not the only benefit of using strategy-proof mechanisms. Such mechanisms also impose minimal costs of searching for and processing strategic information, and they do not discriminate among agents based on their access to information and ability to strategize (cf. Vickrey, 1961; Dasgupta, Hammond, and Maskin, 1979; Pathak and Sönmez, 2008). 5Pareto efficiency is, on one hand, the baseline efficiency requirement, and on the other hand, it does not indicate which of the possibly many Pareto-efficient matchings to choose. For instance, Arrow (1963), pp. 36-37, discusses the partial ordering of outcomes given by Pareto dominance, and observes: “But though the study of maximal alternatives is possibly a useful preliminary to the analysis of particular social welfare functions, it is hard to see how any policy recommendations can be based merely on a knowledge of maximal alternatives. There is no way of deciding which maximal alternative to decide on.” 6See e.g. Sen (1970,1999) for analysis of welfare with partial orderings.

3 and independence-of-irrelevant-alternatives postulates (Arrow, 1963): (i) a SWF is Pareto if it ranks any matching strictly below any other matching that Pareto dominates it, and (ii) a SWF satisfies the independence of irrelevant alternatives if, given any two profiles of preferences and any two matchings that are socially comparable under both profiles, if all agents rank the two matchings in the same way under both profiles, then the social ranking of the two matchings is the same under both profiles. We call a mechanism Arrovian efficient with respect to a SWF if, for all preference profiles, the resulting matching is the unique maximum of the SWF.7 For shortness we say that a mechanism is Arrovian efficient if it is Arrovian efficient with respect to some SWF. Our first main result (Theorem 1) establishes that a mechanism is individually strategy- proof and Arrovian efficient if and only if the mechanism is group strategy-proof and Pareto efficient. Both directions of the equivalence are noteworthy. First, the equivalence tells us that requiring individual strategy-proofness and Arrovian efficiency guarantees group strategy-proofness. As discussed above, group strategy-proofness is a very desirable property of an allocation mechanism. Second, mechanisms such as Serial Dictatorships or Top Trading Cycles (defined below) were known to be group strategy-proof and Pareto efficient; our equivalence allows us to conclude that they are also Arrovian efficient—there are Arrovian SWF that rationalize them. As far as we know, the present paper is the first to connect the literature on allocation and exchange and the literature on Arrovian preference aggregation. In particular, we seem to be the first to recognize the equivalence of Theorem 1. However, stronger equivalence results—which do not hold true in our setting—are familiar from studies of voting. In voting—unlike in our problem—all agents have strict preferences among all outcomes. In the class of Pareto efficient mechanisms, individual strategy-proofness is then equivalent to group strategy-proofness (Gibbard, 1973, and Satterthwaite, 1975).8 This stronger equivalence fails in our setting as it admits individually strategy-proof and Pareto-efficient mechanisms that fail group strategy-proofness.

7There is a rich social choice literature on the correspondence between choice and the maximum of the SWF ranking in the context of social choice (see below). This literature is interested in rationalizing social choice rather than efficiency of allocation mechanisms, and hence it says that a mechanism, or social choice, is “rationalized by a SWF” rather than “efficient with respect to a SWF.” 8The equivalence of Theorem 1 also has counterparts in the social choice literature on restricted preference domains—such as single-peaked preferences—in which there are non-dictatorial strategy-proof and Arrow efficient rules. For instance, Moulin (1988) extends a result by Blair and Muller (1983) and shows that in environments such as single-peaked voting, if an Arrovian SWF is monotonic, then the mechanism picking its unique maximal element is group strategy-proof. In particular, this implies that in single-peaked voting individual strategy-proofness and group strategy-proofness are equivalent with no need to restrict attention to efficient mechanisms. In contrast, in allocation environments the equivalence results from the conjunction of incentive and efficiency assumptions, and the equivalence of incentive assumptions alone is not true.

4 The equivalence of Theorem 1 leads to a question: what mechanisms are individually strategy-proof and Arrovian efficient? Our second main result, Theorem 2, answers this question and constructs the full class of individually strategy-proof and Arrovian efficient mechanisms, or, equivalently, the full class of group strategy-proof and Pareto efficient mechanisms. This new class of mechanisms—which we call trading-cycles mechanisms, or trading cycles for shortness—is closely related to David Gale’s top-trading-cycle mechanism (reported by Shapley and Scarf, 1974), and especially its generalization by Pápai (2000) (known as hierarchical exchange, or simply top trading cycles). Let us describe trading cycles in the special case of our environment in which there are as many objects as agents and each agent initially controls an object. First consider Gale’s top trading cycles. The top-trading-cycle algorithm resembles decentralized trading and matches agents and objects in a sequence of rounds. In each round, each object points to the agent who controls it and each agent points to his most preferred unmatched object. Since there are a finite number of agents, there exists at least one pointing cycle in which an agent, say agent 1, points to an object, say object A; the agent who controls object A points to object B, etc.; and finally the last agent in the cycle points to the object controlled by agent 1. The pointing cycles might be short (agent 1 points to object A, which points back to agent 1) or might involve many agents. The procedure then matches each agent in each pointing cycle with the object to which he points. The pointing cycles thus become cycles of trading. Rounds are repeated until no agents and objects are left unmatched. Gale’s top-trading-cycle mechanism is a special case of trading cycles; Roth (1982) showed that it is group strategy-proof and Pareto efficient. Other examples of trading cycles obtain when we take one of the agents—let us call him a broker—and change the way he can trade the object he controls—which we call the brokered object, or the brokered house. We do so by running the same algorithm as above except that we make the broker point to his most preferred unmatched object that is different from the brokered object. Surprisingly, we prove that this modification of top trading cycles remains group strategy-proof and Pareto efficient (and hence, by Theorem 1, also Arrovian efficient).9 Even more surprisingly, this slight modification of top trading cycles gives us the full class of group strategy-proof and efficient mechanisms. While we described top trading cycles and trading cycles for a particular environment, the same algorithms can be used in more general environments, for instance when all objects

9It is natural to ask whether we can run an analogue of trading cycles with more than one broker in a given round. The answer is negative; such a mechanism would not be strategy-proof and efficient. As we explain in the paper, at-most-one-broker-per-round is an inherent feature of group strategy-proofness and efficiency, and not merely a convenient simplification.

5 are socially endowed. In such environments, to run top trading cycles we need to specify for each round and each object which agent controls it (see Abdulkadiroğlu and Sönmez, 1999; Pápai, 2000); to run trading cycles we additionally need to specify for every round who, if anyone, is the broker. Provided we are careful how the control rights change from round to round, the resulting mechanisms are group strategy-proof and efficient, and no other mechanisms are.10 The main insight brought by our characterization is that every individually strategy- proof and Arrovian efficient mechanism can be obtained by specifying agents’ control rights, and allowing them to swap objects. In this sense, our result can be seen as a variant of the Second Fundamental Welfare theorem for the setting without transfers and with single-unit demands. Knowing the full class of individually strategy-proof and Arrovian efficient mechanisms, allows us to derive some further properties shared by all such mechanisms. In particular, we show that in any such mechanism, for any preference profile, there is a group of agents—the decisive group—all of whom can get one of their two top choices, and all but at most one of whom can get their top choice, irrespective of preferences submitted by agents not in the group. In the trading-cycle algorithm, the decisive group consists of agents who trade in the first round.11 We further show that all strategy-proof and efficient mechanisms have arecursivestructure:themembersofthedecisivegroupdeterminetheirallocation;given their preferences there is another group of agents who obtain one of top two choices among remaining objects, and who can determine their allocation irrespective of the preferences of others, etc. For instance, in a sequential dictatorship (Satterthwaite and Sonnenschein, 1981; Svensson, 1994, 1999; Ergin, 2000), which is a special case of trading cycles, the first dictator chooses his most preferred object, then a second dictator chooses his most preferred object among the objects which were not chosen by prior dictators, and so forth (we refer to the mechanism as serial dictatorship if the sequence of dictators is exogenously given). Furthermore, knowing that all individually strategy-proof and Arrovian efficient mechanisms may be represented as trading cycles allows one to determine what can and cannot

10We study environments both with and without outside options. The results are the same in both environments, but the above algorithm needs to be slightly generalized in the case of outside options by allowing agents to point to objects or their outside options. We also need to postpone matching a broker with his outside option until a round in which an agent who owns an object lists the brokered object as his most preferred one. 11AsimilarpointwasmadebySen(1970)andGibbard(1969)inthecontextofvoting:everySWF whose ranking of outcomes is a quasi-ordering is determined by the preferences of a group of agents they call oligarchs. Notice that in the context of allocation, the result is more subtle in that who belongs to the decisive group can depend on the proﬁle of preferences, and we might have one member of the decisive group whose preference ranking co-determines the allocation and who obtains one of his top two choices but not necessarily his top choice.

6 be achieved in a strategy-proof way. The characterization radically simplifies analysis of such questions because it allows us to restrict our attention to trading cycles without loss of generality (we provide examples of such a radical simplification below). In this sense, the role trading-cycles mechanisms play in the single-unit demand no-transfers environments we study, can be compared to, for instance, the role that the mechanisms of Vickrey (1961), Clarke (1971), and Groves (1973) play in environments with transfers and quasi-linear utili- ties (cf. Green and Laffont, 1977, and Holmstrom, 1979). Other characterizations of efficient and strategy-proof mechanisms that are non-dictatorial have been obtained by Barberà, Jackson, and Neme (1997) for sharing a perfectly divisible good among agents with single- peaked preferences over their shares; and by Barberà, Gül, and Stacchetti (1993) for voting problems with single-peaked preferences. To illustrate how Theorems 1 and 2 simplify the analysis of many otherwise difficult questions, we use them to obtain new insights into allocation and exchange, as well as to show that some of the deepest prior results on allocation in environments with single-unit demands and no transfers are their immediate corollaries. First, we apply our results to the problem of exchange of goods without transfers and with single-unit demands. For example, in kidney exchange, patients (agents) come with a paired- donor kidneys (objects) and have to be matched with at least their paired-donor kidney. Another example is the allocation of dormitory rooms at universities that give some students, such as sophomores, the right to stay in the room they lived in the preceding year. Such exogenous control rights are straightforwardly accommodated by our mechanism class. When some objects are private endowments of agents it is natural to require that the participation in the mechanism is individually rational so that each agent likes the mechanism’s outcome at least as much as the best object from his endowment. We show that the class of individually strategy-proof, Arrovian efficient, and individually rational mechanisms equals the class of individually rational trading-cycles mechanisms. A trading-cycles mechanism is individually rational if and only if (i) it may be represented by a consistent control rights structure in which each agent is given control rights over all objects from his endowment, and (ii) none of these agents is a broker. In particular, we show that when each agent has a private endowment, top-trading-cycles mechanisms are the unique mechanisms that are individually strategy-proof, Arrovian efficient, and individually rational. In the special case of our setting in which there are as many objects as agents and each agent is endowed with exactly one object, this corollary of Theorems 1 and 2 is implied by an earlier result of Ma (1994).12

12Ma shows that Top Trading Cycles is the unique strategy-proof, Pareto-eﬃcient, and individually-rational mechanism in the discrete exchange economy with single-unit demand and single-unit endowment introduced by Shapley and Scarf (1974). There exists a unique core allocation in such an economy that can be reached by Gale’s TTC algorithm (cf. Shapley and Scarf, 1974 and Roth and Postlewaite, 1977). Konishi, Quint,

7 Second, we show that sequential dictatorships, defined above, are the only mechanisms that are individually strategy-proof and Arrovian efficient with respect to a SWF that always generates complete orderings.13 Dictatorships are the benchmark strategy-proof and efficient mechanisms in many areas of economics. For instance, Gibbard (1973) and Satterthwaite (1975) have shown that all strategy-proof and unanimous voting rules are dictatorial.14 Still, we find it surprising that this corollary of Theorems 1 and 2 holds true in our environment because—in contrast to the environments where this question was previously studied—ours allows many individually strategy-proof (and even group strategy-proof) and Pareto efficient mechanisms that are not dictatorial. Third, we show that the some of the deep prior insights of the rich literature on allocation with no-transfers are immediately implied by Theorem 2. Pápai (2000)—the prior work closest to our paper—constructed a class of mechanisms referred to as top trading cycles or hierarchical exchange, which use the same algorithm as Gale’s top-trading-cycles mechanism with the exception that the mechanism takes as an input a structure of control rights (without brokers) over objects that—for each round of the mechanism and each unmatched object— determines the agent to whom the object points. She then showed that all group strategy- proof and Pareto efficient mechanisms that satisfy an additional technical property (that she refers to as reallocation-proofness) are in her class.15 This result is implied by Theorem 2 because trading cycles with brokers do not satisfy Papai’s reallocation-proofness property.16 and Wako (2001) considered an extension when agents have multi-unit demands and endowments. They showed that a core allocation may not exist when agents have additive preferences over multiple objects. Pápai (2007) showed that when we can rule out some of the types of trades that agents are allowed to make in this multi-unit model, then an extension of Ma’s characterization can be restored. 13We allow outside options in this result; without outside options we show that this subclass of trading cycles is slightly larger than the class of sequential dictatorships. 14Dasgupta, Hammond, and Maskin (1979) extended this result to more general social choice models, Satterthwaite and Sonnenschein (1981) extended it to public goods economies with production, Zhou (1991) extended it to pure public goods economies, and Hatfield (2009) to group strategy-proof quota allocations. In exchange economies, Barberà and Jackson (1995) showed that strategy-proof mechanisms are Pareto inefficient. 15A mechanism is reallocation-proof in the sense of Pápai if there is no profile of preferences with a pair of agents and a pair of preference manipulations such that (i) if both of them misrepresent their preferences, both of them weakly gain and one of them strictly gains by swapping their assignments, and (ii) if only one of them misrepresents his preferences, he cannot change his assignment. Pápai also notes that the more natural reallocation-proofness-type property obtained by dropping condition (ii) conflicts with group strategy-proofness and Pareto efficiency as does allowing the swap of assignments among more than two agents. We do not use reallocation-proofness in our results. 16All allocation papers cited above, and the literature in general, shares with our paper the assumption that agents have strict preferences. This is the standard modeling assumption because—as Ehlers (2002) shows— “one cannot go much beyond strict preferences if one insists on efficiency and group strategy-proofness.” The full preference domain gives rise to an impossibility result, i.e., when agents can be indifferent among objects, there exists no mechanism that is group strategy-proof and Pareto efficient. For this reason, participants are frequently allowed to submit only strict preference orderings to real-life direct mechanisms in various markets, such as dormitory room allocation, school choice, and matching of interns and hospitals.

8 Svensson (1999) showed that a mechanism is neutral and group strategy-proof if and only if it is a serial dictatorship; neutrality means that a mechanism is invariant to any renaming of objects. This result follows from Theorem 2 because neutral and group strategy-proof mechanisms are Pareto eﬃcient, and because, to be neutral, a trading-cycle mechanism must be a serial dictatorship. Finally, one of the auxiliary contributions of our paper is to recognize the role of brokers in allocation and exchange problems with no transfers. In the context of our paper, the main role played by the brokers is to allow us to construct the full class of strategy-proof and eﬃcient mechanisms. The brokers can also be useful in some mechanism design settings, and we close the paper by providing an example of such a setting. In the example, the trading cycle with one broker described above is the most equitable allocation mechanism. In particular, we prove that it is strictly more equitable—in the sense of Lorenz dominance— than any top-trading-cycles mechanism.

2Model

2.1 Environment

Let I be a set of agents and H be a set of objects that we often refer to as houses following the standard terminology of the literature. We use letters i, j,k to refer to agents and h, g,e 17 to refer to houses. Each agent i has a strict preference relation over H,denotedby i. Let Pi be the set of strict preference relations for agent i,andletPJ denote the Cartesian product i J Pi for any J I.Anyprofilefrom =( i)i I from P PI is called a ⇥ 2 ✓ 2 ⌘ preference profile.Forall P and all J I,let J =( i)i J PJ be the restriction of 2 ✓ 2 2 to J. To simplify the exposition, we make two initial assumptions. Both of these assumptions are fully relaxed in subsequent sections. First, we initially restrict attention to house allocation problems. A house allocation problem is the triple I,H, (cf. Hylland and h i Zeckhauser, 1979). Throughout the paper, we fix I and H,andthus,aproblemisidentified with its preference profile. In Section 6.1, we generalize the setting and the results to house allocation and exchange by allowing agents to have initial rights over houses. The results on allocation and exchange turn out to be straightforward corollaries of the results on (pure) allocation. Second, we initially follow the tradition adopted by many papers in the literature (cf. Svensson, 1999) and assume that H I so that each agent is allocated a house. This | || | 17 By i we denote the induced weak preference relation; that is, for any g, h H, g i h g = h or g h. ⌫ 2 ⌫ () i

9 assumption is satisfied in settings in which each agent is always allocated a house (there are no outside options), as well as in settings in which agents’ outside options are tradable, effectively being indistinguishable from houses. In Section 5.2, we allow for non-tradable outside options and show that analogues of our results remain true irrespective of whether H I or H < I . | || | | | | | An outcome of a house allocation problem is a matching. To define a matching, let us start with a more general concept that we will use frequently. A submatching is an allocation of a subset of houses to a subset of agents, such that no two different agents get the same house. Formally, a submatching is a one-to-one function : J H; where for ! J I,usingthestandardfunctionnotation,wedenoteby(i) the assignment of agent ✓ 1 i J under ,andby (h) the agent that got house h (J) under .Let be the 2 2 S set of submatchings. For each ,letI denote the set of agents matched by and 2S H H denote the set of houses matched by .Forallh H,let h be the set of ✓ 2 S ⇢S submatchings such that h H H, i.e., the set of submatchings at which house h is 2S 2 unmatched. In virtue of the set-theoretic interpretation of functions, submatchings are sets of agent-house pairs, and are ordered by inclusion. A matching is a maximal submatching; that is, µ is a matching if Iµ = I.Let be the set of matchings. We will write 2S M⇢S I for I I,andH for H H for short. We will also write for . M SM A mechanism is a mapping ' : P that assigns a matching for each preference ! M profile (or, equivalently, for each allocation problem).18

2.2 Strategy-Proofness and Eﬃciency

Amechanismisindividuallystrategy-proofiftruthfulrevelationofpreferencesisaweakly dominant strategy for any agent: a mechanism ' is individually strategy-proof if for all

P, there is no i I and 0 Pi such that 2 2 i2

'[ i0 , i](i) i '[ ](i).

Amechanismisgroupstrategy-proofifthereisnogroupofagentsthatcanmisstatetheir preferences in a way such that each one in the group gets a weakly better house, and at least one agent in the group gets a strictly better house, irrespective of the preference ranking of the agents not in the group. Formally, a mechanism ' is group strategy-proof if for all

18We study direct mechanisms. By the revelation principle, this is without loss of generality. See Appendix Aforadiscussion.

10 P,thereexistsnoJ I and 0 PJ such that 2 ✓ J 2

'[ J0 , J ](i) i '[ ](i) for all i J, ⌫ 2 and

'[ J0 , J ](j) j '[ ](j) for at least one j J. 2 AmatchingisParetoefficientifnoothermatchingwouldmakeeverybodyweaklybetter off, and at least one agent strictly better off. That is, a matching µ is Pareto efficient 2M if there exists no matching ⌫ such that for all i I, ⌫(i) i µ(i), and for some i I, 2M 2 ⌫ 2 ⌫(i) i µ(i).AmechanismisPareto efficient if it finds a Pareto-efficient matching for every problem. Pareto efficiency is a weak efficiency requirement.19 In order to define the stronger concept of Arrovian efficiency with respect to a social welfare function, denote by P M the set of strict partial orderings over matchings; we refer to elements of P M as social rankings. A social welfare function (SWF) :P P M maps agents’ preference profiles to social ! rankings. A SWF is Pareto (or unanimous) if: for every preference profile and any two matchings µ, ⌫ ,ifµ(i) i ⌫(i) for all i I, with at least one preference strict, then µ 2M ⌫ 2 is ranked above ⌫ in the social ranking, µ( ) ⌫.ASWF satisfies the independence of irrelevant alternatives if: for all , 0 P and all µ, ⌫ ,ifallagentsrankµ and ⌫ in 2 2M the same way and both ( ) and ( 0) rank µ and ⌫ then µ( 0)⌫ µ( )⌫.We () restrict attention to SWFs that satisfy the Pareto and independence-of-irrelevant-alternatives postulates. Notice that Pareto dominance is a standard example of a SWF. Amatchingµ is Arrovian efficient with respect to a social ranking ( ) if it maximizes the social welfare, that is µ( )⌫ for all ⌫ µ .Amechanism is Arrovian efficient 2M\{ } with respect to a SWF if for any profile of agents’ preferences ,thematching ( ) is Arrovian efficient with respect to ( ).If is Arrovian efficient with respect to some SWF, we simply say that it is Arrovian efficient. The next section offers two examples illustrating the concept of Arrovian efficiency.

3MainResults:Equivalence

In Theorem 1, we establish the equivalence between three of the pairs of our incentive- compatibility and eﬃciency concepts. In addition, Example 2 below demonstrates that the

19In particular, when imposed on group strategy-proof mechanisms, Pareto eﬃciency is equivalent to assuming that the mechanism maps P onto the entire set of matchings . This surjectivity property is M known as citizen sovereignty, or full range.

11 class of individually strategy-proof and Pareto eﬃcient mechanisms is a strict superset of the mechanisms satisfying any of the equivalent conditions of the theorem.

Theorem 1. Amechanismisindividuallystrategy-proofandArrovianefficientifandonly if it is group strategy-proof and Pareto efficient, and if and only if it is group strategy-proof and Arrovian efficient.

To illustrate this equivalence and our concepts let us look a the setting with three agents

1, 2,and3,threeobjects(houses)h1, h2,andh3, and no outside options. Consider the following two examples of mechanisms.

Example 1. The serial dictatorship in which 1 chooses first, and 2 chooses second is well- known to be group strategy-proof and Pareto efficient. It is straightforward to see that this serial dictatorship is Arrovian efficient with respect to the following SWF: µ is ranked strictly above ⌫ if and only if (a) 1 strictly prefers µ to ⌫,or(b)1 is indifferent and 2 strictly prefers µ to ⌫.

Example 2. Let us now modify the serial dictatorship of the previous example and consider mechanisms in which 1 chooses first; then 2 chooses second if 1 prefers h2 over h3,else 3 chooses second. This mechanism is an example of a sequential dictatorship, and is also individually strategy-proof and Pareto efficient. However, mechanism is neither Arrovian efficient nor group strategy-proof. To see the latter point let us look at the following two preference profiles:

1: h h h , 2: h h h , 3: h h h , 1 2 3 1 2 3 1 2 3

1: h 0 h 0 h , 2: h 0 h 0 h , 3: h 0 h 0 h . 1 3 2 1 2 3 1 2 3 Notice that

( )= (1,h ) , (2,h ) , (3,h ) , { 1 2 3 } ( 0)= (1,h ) , (2,h ) , (3,h ) . { 1 3 2 }

The mechanism fails group strategy-proofness. For instance, when the true preference profile is ,thenagents1 and 3 have a profitable manipulation 0 1,3 . The mechanism { }{ } also fails Arrovian efficiency. Indeed, by way of contradiction assume that is Arrovian efficient with respect to some SWF . Then, ( ) ranks allocation ( ) strictly above ( 0),and ( 0) ranks ( 0) strictly above ( ).But,thisviolatestheindependenceof the irrelevant alternatives, a contradiction that shows that is not Arrovian efficient.

12 The proof of Theorem 1 builds on Example 2. As a preparation for the proof, let us notice three properties of group strategy-proofness. First, in the environment we study group strategy-proofness is equivalent to the conjunction of two non-cooperative properties: individual strategy-proofness and non-bossiness.20 Non-bossiness (Satterthwaite and Son- nenschein, 1981) means that no agent can misreport his preferences in such a way that his allocation is not changed but the allocation of some other agent is changed: a mechanism ' is non-bossy if for all P, there is no i I and 0 Pi such that 2 2 i2

'[ i0 , i](i)='[ ](i) and '[ i0 , i] = '[ ]. 6

The following lemma is due to Pápai (2000):

Lemma 1. Pápai (2000) A mechanism is group strategy-proof if and only if it is individually strategy-proof and non-bossy.

Second, in the environment we study group strategy-proofness is equivalent to Maskin monotonicity (Maskin, 1999). A mechanism ' is Maskin monotonic if '[ 0]='[ ] whenever 0 P is a '-monotonic transformation of P. Apreferenceproﬁle 0 P is a 2 2 2 '-monotonic transformation of P if 2

h H : h i '[ ](i) h H : h 0 '[ ](i) for all i I. { 2 ⌫ }◆{ 2 ⌫i } 2

Thus, for each agent, the set of houses better than the base-proﬁle allocation weakly shrinks when we go from the base proﬁle to its monotonic transformation. The following lemma was proven by Takamiya (2001) for a subset of the problems we study; his proof can be extended to our more general setting.

Lemma 2. Amechanismisgroupstrategy-proofifandonlyifitisMaskinmonotonic.

Finally, let us notice the following

Lemma 3. If a mechanism is group strategy-proof then no agent can change the outcome of by changing the ranking of objects worse than the object he obtains, that is if 0 diﬀers from only in how some agent i ranks objects below ( )(i) then ( 0)= ( 0). We skip the straightforward proof of this last lemma since we later prove, without reliance on this lemma or Theorem 1, a substantially stronger result, Theorem 2.

20Both of these properties are non-cooperative in the sense that they relate a mechanism’s outcomes under two scenarios when a single agent makes unilateral preference revelation deviations.

13 Proof of Theorem 1. Notice that it is sufficient to show that individual strategy- proofness and Arrovian efficiency are equivalent to group strategy-proofness and Pareto efficiency as the third equivalence then follows. First, consider an individually strategy-proof mechanism that is Arrovian efficient with respect to some SWF .InlightofLemma1,toestablishthefirstimplicationitisenough to show that is Pareto efficient and non-bossy. To show that is Pareto efficient, suppose that for some P, [ ] is not Pareto 2 efficient. Then, there exists some µ [ ] such that µ(i) i [ ](i) for all i, with a 2M\{ } ⌫ strict preference for at least one agent. Since satisfies the Pareto postulate, µ ( ) [ ], which contradicts the assumption that is Arrovian efficient with respect to .

To show that is non-bossy, let P and 0 Pi be such that 2 i2

[ ](i)=[ i0 , i](i).

Denote 0=( i0 , i).Since is Arrovian efficient with respect to ,thematching[ ] is ranked as the unique first by ( ) and the matching [ 0] is ranked as the unique first by ( 0). Thus, [ ] and [ 0] are comparable under both ( ) and ( 0),andindependence of irrelevant alternatives implies that [ ] and [ 0] are ranked in the same way by ( ) and ( 0).Wecanthusconcludethat [ ]= [ 0]. This establishes that is non-bossy. Second, consider a group strategy-proof and Pareto efficient mechanism .Wedefine the SWF as follows: for any profile of preferences and any matchings µ and µ0 = µ, 6 matching µ is ranked by ( ) above µ0 iffeither (i) we have µ = ( ) or (ii) for all agents i,wehaveµ (i) %i µ0 (i).NotethatParetoefficiencyof implies that conditions (i) and (ii) are consistent with each other, and hence, that the SWF is well-defined. By definition, satisfies the Pareto postulate. Furthermore, is transitive: if ( ) ranks µ1 above µ2 and it ranks µ2 above µ3 then it ranks µ1 above µ3.Indeed,ifoneofthe µi (for i =1, 2, 3)equals ( ),thenitmustbethatµ1 = ( ) and the claim is proved. If none of the µi equals ( ),thenagentsunanimouslyrankµ1 above µ2 and unanimously rank µ2 above µ3;wecanconcludethattheagentsunanimouslyrankµ1 above µ3 and thus ( ) ranks µ1 above µ3. It remains to check that satisfies the independence of irrelevant alternatives. Take two 1 2 preference profiles and such that each agent ranks two matchings, say µ and µ0,in the same way under the two preference profiles. If the two matchings are comparable under both ( 1) and ( 2), then one of the following cases obtains: Case 1: one of the matchings is unanimously preferred to the other under 1;thenthe same unanimous preference obtains under 2 and the claim is true.

14 Case 2: there is no unanimous ranking of the two matchings under 1;thenunanimity cannot obtain under 2 either. Since, the matchings are ranked, it must be that ( 1) and 2 1 2 ( ) take value in µ, µ0 .Say, ( )=µ;thenweneedtocheckthat ( )=µ as well. { } By Lemma 2, we can assume that each agent i ranks µ (i) and µ0 (i) at the top of his ranking under both 1 and 2.Furthermore,byLemma3onlyrankingsofobjectsaboveagents’ allocations (and including their allocations) aﬀect the outcome of a group strategy-proof mechanism; we can thus conclude that ( 1)= ( 2). QED

4TheConstructionofTrading-CyclesMechanisms

We have established that individual strategy-proofness and Arrovian eﬃciency are equivalent to group strategy-proofness and Pareto eﬃciency. We now determine which mechanisms satisfy these properties. Starting with some examples, we construct the full class of such mechanisms; we call them trading cycles (TC).

4.1 Example: Top Trading Cycles

To set the stage for our trading-cycles (TC) mechanism, let us look at the well-known top- trading-cycles (TTC) algorithm adapted by Pápai (2000) to house allocation problems.21 The class of mechanisms presented in this subsection is identical to Pápai’s “hierarchical exchange” class. Our presentation, however, is novel and aims to simultaneously simplify the earlier constructions of Pápai’s class, and to introduce some of the terminology we will later use to introduce our class of all group strategy-proof and eﬃcient mechanisms (TC). TTC is a recursive algorithm that matches houses to agents in a sequence of rounds. In each round, some agents and houses are matched. The matches will not be changed in subsequent rounds of the algorithm. At the beginning of each round, each unmatched house is “owned” by an unmatched agent. The algorithm creates a directed graph in which each unmatched house points to the agent who owns it, and each unmatched agent points to his most preferred house among the unmatched houses. In the resultant directed graph there exists at least one exchange cycle in which agent 1’s most preferred house is owned by agent 2, agent 2’s most preferred house is owned by agent 3, ..., and ﬁnally, for some k =1, 2,...,agentk’s most preferred house is owned by agent 1. Moreover, no two exchange cycles intersect. The algorithm matches all agents in exchange cycles with their most preferred houses.

21The algorithm was originally proposed by David Gale for the special case of house exchange (cf. Shapley and Scarf, 1974).

15 The algorithm terminates when all agents are matched. As at least one agent-house pair is matched in every round, the algorithm terminates after ﬁnitely many rounds. As we see, the outcome of the TTC algorithm is determined by two types of inputs: agents’ preferences and agents’ rights of ownership over houses. The preferences are, of course, submitted by the agents. The ownership rights are deﬁned exogenously as part of the mechanism.22 We formalize this aspect of the mechanism via the following concept.

Deﬁnition 1. A structure of ownership rights is a collection of mappings c : H I . ! 2M The structure of ownership rights c is consistent if { } 2M

1 1 c (i) c (i) if 0 and i I . ✓ 0 ✓ 2 M 2 0

The structure of ownership rights tells us at each submatching which unmatched agent owns any particular unmatched house. Agent i owns house h at submatching when c(h)= i. Consistency means that whenever an agent owns a house at a submatching ()thenhe also owns it at any larger submatching (0)aslongasheisunmatched.

Each consistent structure of ownership rights c determines a hierarchical exchange { } 2M mechanism of Pápai (2000). This class consists of mechanisms whose outcomes are found by running the TTC algorithm with consistent structures of ownership rights. Because of this, we will also refer to hierarchical exchange as TTC mechanisms.Pápaishowedthatall TTC mechanisms are group strategy-proof and Pareto eﬃcient, extending an earlier insight of Roth (1982).23

4.2 Example: Beyond Top Trading Cycles

What might a group strategy-proof and eﬃcient non-TTC mechanism look like? Consider the following example that builds on the TTC idea.

Example 3. Consider three agents i1,...,i3 and three houses h1,...,h3 and an ownership

22Recall that we are studying an allocation problem in which objects are a collective endowment. In Section 6.1 we will enlarge the analysis to include exchange problems among agents with private endowments. In exchange problems, some of the mechanism’s ownership rights are determined by individual rationality constraints. Notice that ownership rights are related to priorities in school choice in that agents with higher priority at an object correspond to agents who own the object at smaller submatchings, while agents with lower priority at this object correspond to agents who own the object at larger submatchings at which previous owners are already matched (see, for instance, Ergin (2002), Abdulkadiroğlu and Sönmez (2003), and Abdulkadiroğlu and Che (2010) for a discussion of TTC and priorities). 23To appreciate the generality of Pápai’s class, notice that the serial dictatorship of Satterthwaite and Son- nenschein (1981) and Svensson (1994) is a special case of the TTC mechanisms in which at each submatching there is an agent who owns all unmatched houses.

16 structure that allocates ownership of houses according to the following table:

h1 h2 h3

i1 i2 i3

i3 i1 i2

i2 i3 i1

Given this structure, let us run TTC with one modiﬁcation: agent i1 is not allowed to point to house h1 as long as there are other unmatched agents. In rounds with other unmatched agents (and hence other unmatched houses), agent i1 will point to his most preferred house 24 among unmatched houses other than h1.

For instance, if each agent i has the preference h1 i h2 i h3 then in the ﬁrst round agents i2 and i3 will point to h1,butagenti1 will point to his second-choice house, h2.We will then have an exchange cycle in which i1 is matched with h2 and i2 is matched with h1.

In the second round, the algorithm matches agent i3 and house h3,andterminates. This mechanism is group strategy-proof and Pareto efficient. An easy recursion may convince us that at each round the submatching formed is Pareto efficient for matched agents. Indeed, if an agent matched in the first round does not get his top choice then he gets his second choice, and getting his first choice would harm another agent matched in that round. In general, agents matched in the n’th round get their first or second choice among houses available in the n’th round, and giving one of these agents a better house would harm some other agent matched at the same or earlier round. To establish group strategy-proofness we may use an argument similar to the standard proof why TTC are group strategy-proof, see Roth (1982). Instead of replicating this argument, let us consider the following concept. For every agent and every round of the algorithm, let us say that the set of objects obtainable by the agent consists of all the objects the agent could obtain in this round by either submitting his true preference ranking or by changing the ranking of not-yet matched objects. One can check that, as long as an agent is unmatched, the agent’s set of obtainable objects stays the same or becomes larger with each round. This monotonicity is what drives the strategy-proofness properties of the mechanism.

The above mechanism is indeed different from all TTC mechanisms. To see this, first observe that the mechanism matches house h1 with agent i2 under the illustrative preference profile analyzed above, whereas it would match h1 with another agent, i3,ifagenti1 submitted preferences h1 i h3 i h2 (and other agents i = i1 continued to have preferences 1 1 6 24Pápai (2000) gives an example of a non-TTC mechanism. Her construction is different from ours though the resultant mechanisms are identical. As we will show in the next section, the advantage of our construction lies in its generalizability to cover the whole class of group strategy-proof and efficient mechanisms.

17 h1 i h2 i h3). However, any TTC mechanism would match h1 with the same agent in these two preference profiles. Indeed, any TTC ownership structure uniquely determines which agent owns h1 at the empty submatching, and this agent would be matched with h1 in the first round of the algorithm under any preference profile in which all agents rank h1 as their first choice.

For future use, notice that in the above example, agent i1 does not have full ownership right over h1.Unlessheistheonlyagentleft,hecannotformthetrivialexchangecyclethat would match him with h1.Hedoeshavesomecontrolrightoverh1,however:hecantrade h1 for houses owned by other agents. In our general trading-cycles algorithm, we will refer to such weak control rights as “brokerage.”

4.3 Trading Cycles

We turn now to our new algorithm, trading cycles (TC), an example of which we saw in the previous section. Like TTC, the TC is a recursive algorithm that matches agents and houses in exchange cycles over a sequence of rounds. TC is more ﬂexible, however, as it allows two types of intra-round control rights over houses that agents bring to the exchange cycles: ownership and brokerage. In our description of the TTC class, each TTC mechanism was determined by a consistent ownership structure. Similarly, each TC mechanism is determined by a consistent structure of control rights.

Deﬁnition 2. A structure of control rights is a collection of mappings

(c,b):H I ownership,brokerage . ! ⇥{ } 2M The functions c of the control rights structure tell us which unmatched agent controls any particular unmatched house at submatching .Agenti controls house h H at 2 submatching when c(h)=i. The type of control is determined by functions b.Wesay that the agent c(h) owns h at if b(h)=ownership, and that the agent c(h) brokers h at if b(h)=brokerage. In the former case we call the agent an owner and the controlled house an owned house.Inthelattercaseweusethetermsbroker and brokered house. Notice that each controlled (owned or brokered) house is unmatched at ,andanyunmatched house is controlled by some uniquely determined unmatched agent. The consistency requirement on TC control rights structures consists of three constraints on brokerage at any given submatching (the within-round requirements) and three constraints on how the control rights are related across diﬀerent submatchings (the across-rounds

18 requirements, which we will introduce after our new algorithm).25

Within-round Requirements. Consider any . 2 M (R1) There is at most one brokered house at . (R2)Ifi is the only unmatched agent at then i owns all unmatched houses at . (R3)Ifagenti brokers a house at ,theni does not own any houses at .

The conditions allow for different houses to be brokered at different submatchings, even though there is at most one brokered house at any given submatching. Requirements R1-R2 are what we need for the TC algorithm to be well defined; R3 is necessary for Pareto efficiency and individual strategy-proofness (see Appendix B). With these requirements in place, we are ready to describe the TC algorithm.

The TC algorithm. The algorithm consists of a ﬁnite sequence of rounds r 1 r =1, 2,.... In each round some agents are matched with houses. By we denote the submatching of agents and houses matched before round r.Before 0 r 1 the ﬁrst round the submatching is empty, that is, = ?.If ,thatis, 2M when every agent is matched with a house, the algorithm terminates and gives r 1 r 1 matching as its outcome. If , then the algorithm proceeds with 2 M the following three steps of round r:

Step 1. Pointing. Each house h H r 1 points to the agent who controls it at 2 r 1 r 1 .Ifthereexistsabrokerat ,thenhepointstohismostpreferredhouse r 1 among the ones owned at . Every other agent i I r 1 points to his most 2 r 1 preferred house in H .

Step 2. Trading cycles. There exists n 1, 2,... and an exchange cycle 2{ }

h1 i1 h2 ...hn in h1 ! ! ! ! !

` `+1 ` in which agents i I r 1 point to houses h H r 1 and houses h points to 2 2 agents i` (here ` =1,...,n and superscripts are added modulo n);

25Properties R1-R6 are defined over submatchings instead of rounds of the TC algorithm. This simplifies the definition of the consistency conditions as it saves us the trouble of keeping track of which submatchings are relevant in the TC algorithm, i.e., which of them can be encountered at the end of a round of a TC algorithm.

19 Step 3. Matching. Each agent in each trading cycle is matched with the house r r 1 he is pointing to; is deﬁned as the union of and the set of newly matched agent-house pairs.

The algorithm terminates when all agents or all houses are matched.

There exists a trading cycle in each round because the number of agents is finite, each agent points to a unique house, and each house points to a unique agent. This also implies that trading cycles cannot intersect, and hence, the matching in Step 3 is well defined. Finally, since we match at least one agent-house pair in every round, and since there are finitely many agents and houses, the algorithm terminates after finitely many rounds. Our algorithm builds on Gale’s top-trading-cycles idea, described in Section 4.1, but allows more general trading cycles than top cycles. In TC, brokers do not necessarily point to their top-choice houses.26 The terminology of owners and brokers is motivated by an imperfect analogy: At any submatching (but not globally through the algorithm), we can think of the broker of house h as representing a latent agent who owns h but prefers any other house over it. The TC algorithm with a control rights structure satisfying R1-R3 determines a mechanism that maps profiles from P to Pareto efficient matchings in .27 To guarantee that the M resulting mechanism is group strategy-proof (and hence also Arrovian efficient) we need to impose the following across-round consistency requirements on the control rights structure.

Across-round Requirements. Consider submatchings ,0 such that 0 = | | +1 and 0 ,andanagenti I that controls a house h H at : | | ⇢ 2 M 2 0 2 0 (R4)Ifi owns h at then i owns h at 0.

(R5)AssumethatatleasttwoagentsfromI0 own houses at .Ifi brokers house h at then i brokers h at 0. 26Looking back at the example of the previous section, we see that the mechanism constructed there was a TC in which agent i1 brokered house h1 while other agents owned houses. The diﬀerence between TTC and TC is encapsulated in Step 1; the other steps are standard. In contrast to TC, all previous developments of Gale’s idea (Shapley and Scarf, 1974)—e.g. the top trading cycles with newcomers (Abdulkadiroğlu and Sönmez, 1999), hierarchical exchange (Pápai, 2000), top trading cycles for school choice (Abdulkadiroğlu and Sönmez, 2003), and top trading cycles and chains (Roth, Sönmez, and Ünver, 2004)—allowed only top trading cycles and had all agents point to their top choice among unmatched houses. All these previous developments may be viewed as using a subclass of TC in which all control rights are ownership rights and there are no brokers (in Section 6.1 we show that TC can easily handle private endowments). 27The recursive argument for the eﬃciency of the non-TTC mechanism from Section 4.2 applies; see Appendix C for details.

20 (R6) Assume that agent i0 I controls h0 H at . Then: 2 2 i0 owns h at (i, h0) ,and [{ } if i0 brokers h0 at but not at 0,theni owns h0 at 0.

AgoodwaytounderstandconditionsR4–R6istolookattheconceptofobtainableobjects introduced in Section 4.2. The set of obtainable objects is empty for agents who control no objects in a particular round. The set is always non-empty for owners. For brokers, the set of obtainable objects can be either empty or non-empty. Conditions R4–R6 are formulated to ensure that for each agent the set of obtainable objects stays the same or becomes larger with each round. Requirements R4 and R5 postulate that control rights persist: agents retain control rights as they move from smaller to larger submatchings, or through the rounds of the algorithm. Persistence of ownership is permanent by R4: if an agent becomes an owner, he remains an owner through the execution of the algorithm until he is matched (i.e., once an owner, always an owner). On the other hand, persistence of brokerage is limited in R5: an agent can potentially leave brokerage through the rounds of the algorithm under certain conditions. R4 (persistence of ownership) is identical to the consistency assumption we imposed on TTC. The ﬁrst example of Section 4.1 illustrated why we need such a persistence assumption for the resultant mechanism to be individually strategy-proof. A similar example might convince us that individual strategy-proofness relies also on requirement R5 (persistence of brokerage); see Appendix B. Requirement R6 has two parts.28 The ﬁrst part (consolation for lost control rights) postulates that when an agent i is matched with a house controlled by i0,theni0 owns the houses previously controlled by i.29 R6’s second part (brokered-to-owned house transition) postulates who obtains the control right over a house when a broker loses his brokerage right.

28Sections 6, 6.1 and 6.3 show that brokers and condition R6 are quite easy to work with. However, to sidestep the complication of condition R6, the reader is invited to keep in mind a smaller class of control rights structures in which both of these requirements are replaced by the following strong form of brokerage persistence: “If 0 < I 1 and agent i brokers house h at then i brokers h at 0.” We think that by | | | | restricting attention to this smaller class of control rights structures, one is not missing much of the flexibility of the TC class of mechanism. We hasten to stress, however, that the complication is there for a reason: there are group strategy-proof and Pareto efficient mechanisms that cannot be replicated by TC control rights structures satisfying the above strengthening of R5-R6. Let us also stress that, a priori, we could expect the class of group strategy-proof and efficient mechanisms to be much more complex than it turned out to be. 29 It is sufficient to restrict R6 to the case when i0 is a broker of h0 at .Nevertheless,weimposethefirst part of R6 on both brokers and owners because this gives a smaller class of control rights structures. A key step in seeing why the restriction of R6 to brokers is sufficient is to recognize that, if i0 controls h0 at ,a round of the TC algorithm generates ,andalaterroundgeneratesasubmatchingthatkeepsi0 unmatched but contains (i, h0) ,thenthecontrolrightofi0 over h0 at must be brokerage. We would like to thank [{ } the referees for drawing our attention to this point.

21 By R5, the broker can only lose the brokerage right between and 0 when no more than one agent is a -owner and 0-owner; this is the agent who obtains the control right at 0 over the house brokered at .RequirementR6isusedtoguaranteebothnon-bossinessand individual strategy-proofness of the mechanism; see Appendix B.

A key implication of R6 and R4 is the transfer of ownership rights to ex-brokers: if i0 brokers h0 at but not at 0,andi I owns h H at ,thenR6’sﬁrstpartimpliesthat 2 0 2 0 i0 owns h at (i, h0) ,andR4furtherimpliesthati0 owns h at 0 (i, h0) .Wereferto [{ } [{ } this consequence of R6 and R4 as broker-to-heir transition. We are now ready to deﬁne our mechanism class.

Deﬁnition 3. Acontrolrightsstructureisconsistent if it satisﬁes requirements R1-R6. The class of TC mechanisms (trading cycles) consists of mechanisms whose outcomes are determined by running the TC algorithm with consistent control rights structures.

The TTC mechanisms of Section 4.1 and the non-TTC mechanism of Section 4.2 are examples of TC. We will denote by c,b the TC mechanism obtained from a consistent control rights structure (c,b) .InSection5.2weenlargeittoallowforagents’ { } 2M outside options (in particular, we then allow agents to ranks some objects as unacceptable), and in Section 7 we adapt this class of mechanisms to exchange problems.

5MainResults:Characterization

Our main characterization result tells us that the class of Trading Cycles mechanisms coincides with the class of group strategy-proof and Pareto-efficient mechanisms, and hence with the class of individually strategy-proof and Arrovian efficient mechanisms (by Theorem 1). We first state and prove this result for the model of allocation in which all objects are acceptable, and then relax this simplifying assumption.

Theorem 2. Amechanismisgroupstrategy-proofandParetoeﬃcientifandonlyifitisa Trading Cycles mechanism.

The argument that Trading Cycles mechanisms are Pareto eﬃcient follows the same recursive steps as the argument for the eﬃciency of the non-TTC mechanism in Section 4.2; see Appendix C for details. The proof that Trading Cycles are group strategy-proof builds on the following simple observation.

22 Lemma 4. If an agent i is unmatched at a round r of the algorithm under preference proﬁles

[ i, i] and [ i0 , i],thenthesamesubmatchingformsbeforeroundr under [ i, i] and [ i0 , i],andhencethecontrolrightsstructureatroundr is the same under [ i, i] and [ i0 , i]. The lemma’s assumption implies that the same submatching was formed before round r whenever agent i submitted preference ranking i or 0 .Hence,therestofthelemma i obtains too: the control rights structures must also be the same at round r. The lemma has an important implication: as long as an agent is unmatched, he cannot influence when he becomes an owner, a broker, or enters the broker-to-heir transition (see the discussion of condition R6) by choosing which preferences to submit. To see intuitively why trading cycles are individually strategy-proof, notice that the above lemma implies that no agent i can improve his match by being matched later. Owners cannot benefit by waiting since they get the best available house at the time they match under . Checking that brokers cannot benefit by waiting is only slightly more subtle. We provide the details in Appendix D. To further show that Trading-Cycles mechanisms are group strategy-proof, recall the lemma of Pápai (2000) (see Lemma 1 above) that implies that to prove group strategy- proofness of an individually strategy-proof mechanism it is enough to show that the mechanism is non-bossy. Proving non-bossiness turns out to be subtle; we provide this part of the proof in Appendix E. To get a sense for this part of the proof, consider a TC mechanism without brokers, and an agent i who gets the same object whether he submits preferences

i or 0 . An inductive argument then shows that the algorithm will go though the same i cycles under =( i, i) and 0=( i0 , i) even if the rounds at which these cycles are formed may differ. If brokers were strongly persistent, the same argument would apply. The subtlety in proving non-bossiness is when a broker loses his brokerage right. Con- dition R5 ensures that cycles of three agents or more are the same under both and 0, but that cycles of one or two agents can be different. For instance, in the setting of Example 8, consider a preference profile in which agents i1 and i3 rank houses h1 i ,i 1 3 h4 i ,i h2 i ,i h3 and agents i2 and i4 rank houses h4 i ,i h2 i ,i h3 i ,i h1.Under 1 3 1 3 2 4 2 4 2 4 this preference profile, i1,i2,i3,i4 ,inthefirstround,brokeri4 obtains object h2 in a cycle { } i4 h2 i2 h4 i4.Howeverifi2 submitted instead preference ranking 0 identical ! ! ! ! i2 to i ,i ,theni4 and i2 would not swap houses in first round. They would both still be 1 3 unmatched in round 2, and i4 would have lost his brokerage right; house h4 would now be owned by i2 (notice that not only it is so in the example but in fact condition R6 requires that i2 owns h4 when i1 becomes matched and i4 looses the brokerage right). Agent i2 would then match with h4 in round 2. In round 3, agent i4 would become owner of h2 (again this is

23 so in the example, and, importantly it is guaranteed by the broker-to-heir transition property of R6). Thus, in round 3 agent i4 would match with h2. While the cycles are different, the allocations are the same. Looking at requirement R6 (and its broker-to-heir corollary) can give us a sense why—even if one or two agent cycles are different at and i0 , i2 —such 2 or a similar scenario is bound to happen. The most interesting part of the proof of Theorem 2 is to show that if a mechanism ' is group strategy-proof and Pareto-efficient then we can construct a TC mechanism c,b that is equivalent to '. The construction proceeds in three natural steps: we first construct the candidate control rights structure (c, b),thenshowthatitsatisfiesconditionsR1-R6,and finally show that the resultant TC mechanism c,b equals '. We define a candidate control rights structure in terms of how ' allocates objects for preferences from some special preference classes. To see how this is done, consider the empty submatching and a house h.If' were a TC and h was owned by an agent then at all preference profiles in which all agents rank h as their most preferred house, ' would allocate h to the same agent – the owner of h at the empty submatching. We thus check whether ' allocates h to the same agent at all above profiles, and if it does, we call this agent the candidate owner of h (in the proof, for brevity, we refer to the candidate owner as the owner*). If ' does not allocate h to the same agent at all above profiles, h is a candidate brokered house. Notice that if ' were a TC and h was brokered by an agent, then at every profile at which every agent ranks h as his most preferred house and some other house h0 as his second-most preferred house, ' would allocate h0 to the same agent – the broker of h at the empty submatching. We thus check whether there is an agent who always gets his second-most preferred house at the above profiles, and if there is such an agent we call this agent the candidate broker of h (broker* for short). Finally, we prove the key result that every house h either has a candidate owner or a candidate broker. This key result is technically the hardest one to obtain in the paper: we establish it by first showing that if all agents rank some house A as their first choice, and some house B as their second choice, then who gets A does not depend on the rest of the preference profile (Lemma 9); we then slowly refine this insight. The construction of candidate control rights at non-empty submatchings is similar. The only modification is that instead of looking at preferences at which all agents agree on their most preferred house (or two most preferred houses), we impose this commonality only on unmatched agents, and at the same time we assume the matched agents rank the houses they are matched with at the top, while all other agents rank matched houses at the bottom. Thanks to the simplifying assumption that H I , the Pareto efficiency of TC mechanisms | || | implies that the above procedure would work well if ' was a TC, and we prove that indeed

24 it works well whenever ' is group strategy-proof and efficient.30 The second step of the proof is to show that the above candidate control rights structure indeed satisfies properties R1-R6. We flesh out the argument in several lemmas. With these lemmas proven, we have constructed a TC mechanism c,b. The last step of the proof is to show that c,b = '. We rely on the recursive structure of TC, and proceed by induction with respect to the rounds of c,b.WeprovidealldetailsofthispartoftheproofinAppendixF.

5.1 Properties of Strategy-Proof and Eﬃcient Mechanisms

Knowing that all individually strategy-proof and Arrovian-efficient mechanisms—equivalently all group strategy-proof and Pareto-efficient mechanisms—are trading-cycles mechanisms allows us to derive properties common to all such mechanisms. Let us start by noticing that in any trading cycle mechanism, and for any preference profile, there is a group of agents—the decisive group—each of whom can get one of their two top choices, and all but at most one of them can get their top choice, irrespective of preferences submitted by agents not in the group.

Corollary 1. (Decisive Group) Fix an individually strategy-proof and Arrovian-eﬃcient mechanism .Foranypreferenceproﬁle ,thereisagroupofagentsI1 I such that: ✓ (i) all agents from I1 get one of their two top choices, and all but at most one of them get their top choices, and (ii) the allocation of agents from I1 does not depend on preferences of agents not in I1,thatisforall 0 we have

( ) I1 = I1 , I0 I1 I1 . | | Notice that this corollary implies that if all agents rank house A first and house B second then who gets A does not depend on how the agents rank houses below B. We further observe that all strategy-proof and efficient mechanisms have a recursive structure: the agents in the decisive group determine their allocation; given their preferences there is another group of agents who obtain one of their top two choices and who can determine their allocation irrespective of the preferences of others, etc. For instance, in a serial dictatorship (Satterthwaite and Sonnenschein, 1981; Svensson, 1994, 1999; Ergin, 2000), which is a special case of trading cycles, the first dictator chooses his most preferred object, then a second dictator chooses his most preferred object among the objects which were not chosen by the prior dictators, and so on until all agents have objects.

30This point in the construction requires more care in the case of H < I ;seeSection5.2. | | | |

25 Corollary 2. (Recursive Structure) Fix an individually strategy-proof and Arrovian-eﬃcient mechanism .Foreverypreferenceproﬁle ,thereisapartitionI1,...,Ik of the set of agents such that: (i) all agents from I` get one of their two top choices among objects unmatched at ( )(I1 ... I` 1),andallbutatmostoneofthemgetstheirtopchoiceamongobjects [ [ unmatched at ( )(I1 ... I` 1),and(ii)theallocationofagentsfromI` does not depend [ [ on preferences of agents not in I1 ... I` 1 I`. [ [ [

5.2 Outside Options

Let us now drop the assumption that H I and allow agents to prefer their (non- | ||| tradable) outside options to some of the houses. Thus, some agents may be matched with their outside options, and we need to slightly modify some of the deﬁnitions. As before, I is the set of agents and H is the set of houses. Each agent i has a strict preference relation

i over H and his outside option, denoted yi.WedenotethesetofoutsideoptionsbyY . The houses preferred to outside option yi are called acceptable for agent i;theremaining houses are called unacceptable for this agent. As before, we denote by Pi the set of agent i’s preference profiles, and PJ = i J Pi for any J I. ⇥ 2 ✓ We generalize the concept of submatching as follows: For J I,asubmatchingisaone- ✓ to-one function : J H Y such that each agent is matched with a house or his outside ! [ option.31 Aterminologicalwarningisinorder.Anaturalinterpretationoftheoutsideoption is remaining unmatched. We will not refer to the outside option in this way, however, in order to avoid confusion with our submatching terminology. As in the main body of the paper, whenever we say that an agent is unmatched at ,werefertoagentsfromI = I I.An agent is considered matched even if he is matched to his outside option. The control rights structures (c, b) and their consistency R1-R6 are defined as before though the meaning of some terms such as submatching has changed, as explained above. In particular, (i) only houses are owned or brokered, the outside options are not; and (ii) control rights are defined for all submatchings, including submatchings in which some agents are matched with their outside options.32 We adjust the definition of round r of the TC algorithm to accommodate the outside

31As before, denotes the set of submatchings, I denotes the set of agents matched by , H H denotes S ✓ the set of houses matched by ,andweusethestandardfunctionnotationsothat(i) is the assignment of 1 1 agent i I , (h) is the agent that got house h (I ),and (Y ) is the set of agents matched to their 2 2 outside options. A matching is a maximal submatching, that is, µ is a matching if I = I.Asbefore, 2S µ is the set of matchings. A mechanism is a mapping ' : P that assigns a matching for each M⇢S ! M preference profile. Mechanisms, efficiency, and group strategy-proofness are defined as before. 32Notice that if a control rights structure is consistent on the domain with outside options, and H I , | || | then the restriction of the control rights structure to submatchings in which all agents are matched with houses is a consistent control rights structure in the sense of Section 4.

26 options as follows: -InStep1weaddtheprovisionsthat:(i)ifanagentprefershisoutsideoptiontoall unmatched houses, the agent points to the outside option; (ii) if there is a broker for whom the brokered house is the only acceptable house, such a broker also points to his outside option; and (iii) the outside option of each agent points to the agent. - In Step 2 we allow exchange cycles in which agents points to their outside options. -InStep3wematchagentsineachexchangecyclethatdoesnotcontainthebroker;we match agents in the exchange cycle of the broker if and only if there is at least one owner r r 1 who points to the brokered house. We also re-define as the union of and the set of agent-house pairs and agent-outside option pairs matched in Step 3. We refer to this modified algorithm as outside-options TC, and when there is no risk of confusion, simply as TC. We refer to the mechanism c,b resulting from running the outside-options TC on consistent control rights structures as outside-options TC,orTC. The outside-options TC mechanism described above can be used to allocate houses in the setting without outside options, and in this setting it is identical to the simpler TC mechanism described previously. In particular, the Step 3 provision that we match the broker if and only if there is at least one owner who points to the brokered house is only binding if the broker points to the outside option.33 In the presence of outside options, the TC class of mechanisms again coincides with the class of Pareto-efficient and group strategy-proof direct mechanisms, and hence with the class of individually strategy-proof and Arrovian efficient mechanisms.

Theorem 3. In the environment with outside options, the following statements are equivalent: -amechanismisindividuallystrategy-proofandArrovianefficient, -themechanismisgroupstrategy-proofandParetoefficient, -themechanismisgroupstrategy-proofandArrovianefficient, -themechanismisanoutside-optionsTrading-Cyclesmechanism.

The proof resembles the proofs of Theorems 1 and 2; the required modiﬁcations are discussed in Appendix G.

33In the presence of the outside options, this provision is important to assure the Pareto eﬃciency of the outside-options TC mechanisms.

27 6Applications

6.1 Individually Rational House Allocation and Exchange

In this section, we generalize the model by allowing agents to have private endowments. The characterizations in the resulting allocation and exchange domains are straightforward corollaries of our main results. We also relate the results to allocation and exchange market design environments.

6.1.1 Model of House Allocation and Exchange

Let = Hi i 0 I be a collection of I +1pairwise-disjoint subsets of H (some of which H { } 2{ }[ | | might be empty) such that i 0 I Hi = H.WeinterprethousesfromH0 as the social [ 2{ }[ endowment of the agents, and houses from Hi, i I, as the private endowment of agent i. 2 A house allocation and exchange problem is a list H, I, , . Since we allow some h H i of the agents to have an empty endowment, the allocation model of Section 2 is contained as a special case with = H, ,..., .WemayfixH, I and ,andidentifythehouse H { ; ;} H allocation and exchange problem just by its preference profile . Matchings and mechanisms are defined as in the allocation model of Section 2. Pareto efficiency and group strategy-proofness are defined in the same way as in Section 2. In particular, the equivalence between group strategy-proofness and the conjunction of individual strategy-proofness and non-bossiness continues to hold true. In addition to efficiency and strategy-proofness, satisfactory mechanisms in this problem domain should be individually rational. A mechanism is individually rational if it always selects an individually rational matching. A matching is individually rational, if it assigns each agent a house that is at least as good as the house he would choose from his endowment. Formally, amatchingµ is individually rational if

µ(i) h i I, h H . ⌫i 8 2 8 2 i

For agents with empty endowments, Hi = ,thisconditionistautologicallytrue.Whilewe ; formulate this deﬁnition for the setting without outside options all the results of this section, and their proofs, remain true if we allow outside options: we then deﬁne a matching µ to be individually rational if µ (i) is at least as good as the outside option and µ(i) i h i ⌫ 8 2 I, h Hi. 8 2

28 6.1.2 Results on Individually Rational Allocation and Exchange

Our main characterization result for house allocation and exchange is now an immediate corollary of Theorems 1 and 2.

Theorem 4. In house allocation and exchange problems, the following three properties are equivalent: amechanismisindividuallyrational, group strategy-proof, and Pareto eﬃcient; amechanismisindividuallyrational,individuallystrategy-proof,andArrovianeﬃcient; and amechanismisanindividuallyrationalTCmechanism.

Furthermore, it is straightforward to identify individually rational TC mechanisms. Re- ferring to control rights at the empty submatching as the initial control rights, let us formulate the criterion for individual rationality as follows.

Proposition 1. In house allocation and exchange problems, a TC mechanism is individually rational if and only if it may be represented by a consistent control rights structure in which each agent is given the initial ownership rights of all houses from his endowment.34

Proof of Proposition 1. To prove individual rationality of the above subclass of TC mechanisms, consider an agent i and assume that at the empty submatching i owns a house h from his endowment. Then R4 ensures that i owns h throughout the execution of the TC algorithm. Thus, the TC mechanism will allocate to i house h or a house that i prefers to h. Now, let be an individually rational TC mechanism. Recall that ownership* was defined in the proof of Theorem 2. For any agent i and house h from i’s endowment, i is owner* of h because individual rationality implies that [ ](i)=h for any P[?,h], which is the 2 set of preference profiles that rank h first for all agents. The construction from the proof of Theorem 2 thus represents and yields a control rights structure that assigns to each agent the initial ownership rights over the houses from his endowment. QED As a corollary of the above two results, we obtain the following characterization for an important subdomain of allocation and exchange problems:

Theorem 5. In house allocation and exchange problems where each agent has a nonempty endowment, the following three properties are equivalent:

34Notice that when one agent is endowed with all houses, there are individually rational mechanisms that might be represented both by a control rights structure that assigns this agent initial ownership rights over all houses, and by an alternative control rights structure that assigns this agent ownership rights over all houses but one, which is brokered by a broker. Except for such situations, however, any control rights structure of an individually rational TC mechanism assigns to each agent the initial ownership rights of all houses from his endowment.

29 amechanismisindividuallyrational, group strategy-proof, and Pareto eﬃcient; amechanismisindividuallyrational,individuallystrategy-proof,andArrovianeﬃcient; and amechanismisaTTCmechanism(akahierarchicalexchange)thatassignsallagentsthe initial ownership rights of houses from their endowment.

Proof of Theorem 5. By Theorem 4, a mechanism ' is individually rational, Pareto eﬃcient and group strategy-proof if and only if there exists an individually rational and consistent control rights structure (c, b) such that ' = c,b. By Proposition 1 we may assume that each agent has initial ownership rights over the houses from their endowment. By condition R4 of consistency all unmatched agents own a house throughout the mechanism, and hence R3 implies that no agent is a broker. c,b is thus a TTC mechanism. QED

This result is a generalization of the result stated by Ma (1994) for the housing market of Shapley and Scarf (1974). A housing market is a house allocation and exchange problem in which I = H and each agent is endowed with a house. In this environment, Ma | | | | characterized TTC (in which agents own their endowments) as the unique mechanism that is individually rational, strategy-proof, and Pareto eﬃcient.

6.1.3 Market Design Environments

The assumptions of Theorem 4 are satisﬁed by the house allocation problem with existing tenants of Abdulkadiroğlu and Sönmez (1999). Theirs is the subclass of house allocation and exchange problems in which each agent is endowed with one or zero houses. In the former case, the agent is referred to as an existing tenant. The house allocation problem with existing tenants is modeled after dormitory assignment problems in US college campuses. In each such college, at the beginning of the academic year, there are new senior, junior, and sophomore students, each of whom already occupies a room from the last academic year. There are vacated rooms by the graduating class and there are new freshmen who would like to obtain a room, though they do not currently occupy any. The assumptions of Theorem 5 are satisﬁed by the kidney exchange with strict preferences (Roth, Sönmez, and Ünver, 2004), and the kidney exchange problem with good Samaritan donors (Sönmez and Ünver, 2006). Kidney transplant patients are the agents and live kidney donors are the houses. Each agent is endowed with a live donor who would like to donate a kidney if his paired-donor receives a transplant in return. Thus, all agents have nonempty endowments. The model also allows for unattached donors known as good Samaritan donors who would like to donate a kidney to any patient. In the US, good Samaritan donors have

30 been the driving force behind kidney exchange since 2006. Many regional programs such as the Alliance for Paired Donation (centered in Toledo, Ohio) and the New England Program for Kidney Exchange (centered in Newton, Massachusetts) have used good Samaritan donors in many of kidney exchanges conducted since 2006 (cf. Rees, Kopke, Pelletier, Segev, Rutter, Fabrega, Rogers, Pankewycz, Hiller, Roth, Sandholm, Ünver, and Montgomery, 2009). The kidney exchange context underscores the importance of group strategy-proofness. The doctors of patients are the ones who have the information about patients’ preferences over kidneys and it is known that doctors (or transplant centers) themselves at times manipulate the system to beneﬁt their patients.35 An individually strategy-proof mechanism that is not group strategy-proof could thus by manipulated by doctors. Group strategy- proofness guarantees that no doctor is able to manipulate the mechanism on behalf of his or her patients without harming at least one of them.

6.2 Complete Social Welfare Rankings

Our main results show that the class of individually strategy-proof and Arrovian efficient mechanisms is exactly the class of group strategy-proof and Pareto efficient mechanisms, which is exactly the class of Trading-Cycles mechanisms. In these results we allowed welfare functions to incompletely rank social outcomes. As an application of the main results, we now show that sequential dictatorships are exactly the mechanisms that are strategy-proof and Arrovian efficient with respect to complete SWF, that is SWF that always rank all outcomes.36 Let us start with an example showing that not all Top Trading Cycles are efficient with respect to a complete Arrovian SWF.

Example 4. Consider allocating two objects to two agents. Let be a top-trading-cycles mechanism in which agent 1 owns house h1 and agent 2 owns house h2 at the empty submatching. We will show that there is no complete SWF such that is eﬃcient.

35Deceased-donor queue procedures are sometimes gamed by physicians acting as advocates for their patients. In particular, in 2003 two Chicago hospitals settled a federal lawsuit alleging that some patients had been fraudulently certified as sicker than they were to move them up on the liver transplant queue (Warmbir, 2003). 36We study the setting with outside options. Without outside options there are non-dictatorial mechanisms that are individually strategy-proof and Arrovian efficient with respect to a complete SWF. Each such mechanisms allocates objects as a sequential dictatorship as long as there are three or more objects left. With only two objects left the mechanism can proceed as a sequential dictatorship, or it can assign the two objects to two different agents, and run a round of TTC. This is similar to a situation from voting theory, wherein there are non-dictatorial mechanisms to vote on two outcomes. The proof of this characterization is based on similar ideas as the proof of Theorem 6 below, and we omit it.

31 Consider the preference proﬁle such that

h2 1 h1 1 and h1 2 h2 2 , ; ; where denotes the outside option. Consider also the following four additional preference ; proﬁles

1 2 1 2 1 2 1 2 1= h , 2= h h , 3= h , 4= h h , 2 ; 2 2 ; 1 1 1 h ; ; ; 2 ; ; where non-listed objects are worse than the outside option .Denote ;

µ = 1 = (1,h ) , (2, ) ; 1 { 2 ; } 2 µ2 = = (1, ) , (2,h2) ; { ; } 3 µ3 = = (1, ) , (2,h1) ; { ; } 4 µ4 = = (1,h1) , (2, ) . { ; }

Now, if there is a complete SWF such that is eﬃcient, then ( 1) ranks ( 1) strictly above ( 4),and,bytheindependenceofirrelevantalternatives,thisimpliesthat ( ) ranks ( 1) strictly above ( 4).Similarly,( 2) ranks ( 2) strictly above ( 1),and,bytheindependenceofirrelevantalternatives,thisimpliesthat( ) ranks ( 2) strictly above ( 1).Further,andagainsimilarly,( 3) ranks ( 3) strictly above ( 2),and,bytheindependenceofirrelevantalternatives,thisimpliesthat( ) ranks ( 3) strictly above ( 2).Finally,( 4) ranks ( 4) strictly above ( 3),and,bythe independence of irrelevant alternatives, this implies that ( ) ranks ( 4) strictly above ( 3).But,then( ) fails transitivity, showing that there does not exist a complete SWF with respect to which is eﬃcient.

We will use this example to prove the following

Theorem 6. Amechanismisindividuallystrategy-proofandArrovianeﬃcientwithrespect to a complete SWF if and only if it is a sequential dictatorship.

Proof. (= ) Consider a mechanism that is individually strategy-proof and eﬃcient ) with respect to a complete Arrovian welfare function. By Theorems 1 and 2, is a Trading c,b Cycles mechanism .Fixanarbitrarypreferenceproﬁle I .

32 We claim that at any round r of the algorithm c,b, there is exactly one agent who controls all objects. We prove it in two steps. First, let us show that there cannot be two (or more) agents who each owns an object.

By way of contradiction, suppose that some agent 1 controls object h1 and some other agent c,b 2 controls object h2 in round r.Let be the submatching created by the algorithm before round r. Consider four auxiliary preference profiles ` that all share the following properties: (i) all agents matched under rank objects under `, ` =1,...,4,inthesame way they rank them under ,(ii)allagentsunmatchedat and different from agents 1 and 2 find all objects to be unacceptable, and (iii) agents 1 and 2 rank all objects matched at

above h1 and h2 and they find all objects other than h1,h2 and objects matched at to be unacceptable. The four profiles differ only in how agents 1 and 2 rank objects h1 and h2, and which of these objects are acceptable to them: the ranking of these two objects is the same as in the four preference profiles of the above example. Notice that

c,b ` = µ , [ ` where µ` are defined as in the above example. Furthermore, the same argument we used in the example shows that there can be no welfare functional that ranks all four µ`,istransitive, and satisfies the independence of irrelevant alternatives. Hence, there is no complete Arrovian welfare function that makes c,b efficient, a contradiction that implies that there cannot be two agents who own objects in a round of the algorithm. As c,b never allows two owners in a round of the algorithm, Proposition 3 in Appendix F.1 allows us to assume that there are no brokers in any round, either. Hence, in each round of the algorithm there is a single agent who controls (and owns) all houses. That means that c,b is a sequential dictatorship. ( =) Consider a sequential dictatorship c,b.WeconstructacompleteArrovianwel- ( fare functional such that c,b is efficient with respect to .Under any two matchings are ranked according to preferences of the first-round dictator; if he is indifferent then the matchings are ranked according to the preferences of the second-round dictator, etc. For- mally, for any P and any two distinct µ, ⌫ ,letµ ( ) ⌫ if and only if there exists 2 2M k 1,..., I such that µ (i1)=⌫ (i1),...andµ (ik 1)=⌫ (ik 1),andagentik strictly 2{ | |} prefers µ (ik) over ⌫ (ik), where agents i1,...,ik are defined recursively: i1 = c ( ),andin ; general i` = c (((i1,µ(i1)) ,...,(i` 1,µ(i` 1)))) for ` =1,...,k.Itisstraightforwardtoverify that is a complete Arrovian welfare functional and that c,b is efficient with respect to . QED

33 6.3 Further Illustrative Applications

In Section 6, we have so far illustrated how our main results allow one to easily obtain new insights into allocation and exchange problems.37 We now show that some of the deepest prior insights easily follow from our Theorem 2.

6.3.1 Serial Dictatorships

Neutrality and group strategy-proofness were characterized through serial dictatorships by Svensson (1999) when there are no outside options. In a serial dictatorship agents are ordered, the ﬁrst agent in the ordering gets his most preferred house, the second agent in the ordering gets her most preferred among houses unassigned to agents higher in the ordering, etc. Whether we allow outside options or not, Svensson’s result is a corollary of Theorem 2 as illustrated below. A mechanism is neutral if, whenever the house names are relabeled in the problem, the mechanism assigns each agent the same house that was assigned in the original problem. Formally, a relabeling of houses is a bijection ⇡ : H H.Foranypreferenceproﬁle P, ! 2 ⇡ ⇡ 1 1 and relabeling ⇡,let P be such that g h ⇡ (g) i ⇡ (h) for all i I and 2 i , 2 g, h H.Amechanism' is neutral if for all relabelings ⇡,all P,andalli I,wehave 2 2 2 '[ ⇡](i)=⇡('[ ](i)). Corollary 1. (Svensson, 1999) A mechanism is group strategy-proof and neutral if and only if it is a serial dictatorship.

Proof of Corollary 1. Let ' be a group strategy-proof and neutral mechanism. Neutrality implies that has full range, that is [P]= .Indeed,foranyµ ,wecantakean M 2M arbitrary P,definerelabeling⇡ so that ⇡('[ ](i)) = µ(i) for all i I,andconcludefrom 2 2 neutrality that '[ ⇡]=µ.AsobservedinSection2,fullrangeandgroupstrategy-proofness imply Pareto efficiency. Thus, ' is a trading cycles mechanism c,b by Theorem 2. It remains to show that any neutral trading cycles mechanism c,b is equivalent to a serial dictatorship. Let .ByR1andR3thereisanagenti I who owns some house 2 M 2 c,b h H at .Inparticular,forany P[; h], [ ](i)=h.Let0 with I = I. 2 2 2 M 0 Let g H .Takearelabeling⇡ such that ⇡(h)=g and ⇡((j)) = 0(j) for all j I. 2 0 2 37Our main results have many additional applications. As an example, consider a mechanism that is invariant, that is for any agent i I and any object h H if for all g %i h we have ( i, i)(i)=g 2 2 () ( i0 , i)(i)=g,thenforallg %i h and all j I we have ( i, i)(j)=g ( i0 , i)(j)=g. 2 () We can then show that is individually strategy-proof and Pareto efficient if and only if it is a hierarchical exchange mechanism of Pápai (2000). For the proof, notice that invariance implies non-bossiness, and hence, together with individual strategy-proofness it implies that is group strategy-proof. The rest of the proof resembles the proof of Corollary 2 below.

34 ⇡ c,b ⇡ Now, P[0; g] and by neutrality [ ](i)=⇡(h)=g. Maskin monotonicity implies 2 c,b that i is allocated the best unmatched house at 0 as long as I0 = I. The mechanism is thus equivalent to a serial dictatorship. QED

6.3.2 Reallocation-proofness

Pápai (2000) showed that group strategy-proof and Pareto eﬃcient mechanisms that satisfy an additional condition can be implemented as hierarchical exchange (i.e., TTC) mechanisms. The condition she relies on is as follows: a mechanism ' is reallocation-proof if there exists no pair of agents i, j I such that for some P, 0 Pi,and 0 Pj with 2 2 i2 j2 '[ i0 , i]='[ j0 , j]='[ ],wehave'[ 0 i,j , i,j ](j) i '[ ](i) and '[ 0 i,j , i,j { } { } { } { } ](i) j '[ ](j). We can derive the key insight of Pápai (2000) as follows: % Corollary 2. (Pápai, 2000) If a mechanism is group strategy-proof, Pareto eﬃcient, and reallocation-proof then it is a hierarchical exchange mechanism.

Proof of Corollary 2. Let ' be a group strategy-proof, eﬃcient, and reallocation-proof mechanism. By Theorem 2, it is equivalent to a reallocation-proof TC mechanism c,b.It remains to show that the control rights structure (c, b) can be chosen in such a way that there are no brokers. Take any submatching . First notice that if there are two owners, j 2 M and k at ,thennohouseis-brokered. Indeed, by way of contradiction assume that some house h is -brokered by an agent i,andlethj be a house owned by j and hk be a house owned by k. Consider a preference proﬁle P[] and such that i Pi[; h, hk], j Pj[; hj], 2 2 2 and k Pk[; h]. Then, the deviation to 0 Pi[; h, hj,hk] and 0 Pj[; h, hj] violates 2 i2 j2 the reallocation-proofness condition. Hence, (c, b) can allow brokers only at submatchings c,b c ,b with a unique owner. But then is equivalent to 0 0 such that (c0,b0) is identical to (c, b) except that at any submatching at which (c, b) gives brokerage right over a house h to an agent i,theprimedcontrolrightsstructure(c0,b0) gives ownership of h to the unique (c, b) owner j at ,anditgivesi the ownership of all unmatched houses at (j, h) . QED [{ }

7Conclusion

We study allocation and exchange in environments without transfers and with single-unit demands. Addressing central concerns of both practical allocation problems and the relevant theoretical literature, we (i) show that a mechanism is individually strategy-proof and always selects the eﬃcient outcome with respect to a social ranking satisfying Arrovian postulates if and only if the mechanism is group strategy-proof and Pareto eﬃcient, and (ii) construct the full class of these mechanisms.

35 Our construction relies on the introduction of brokers to allocation and exchange problems. While in the context of our paper, the main role played by the brokers is to allow us to construct the full class of strategy-proof and eﬃcient mechanisms, let us conclude with an example showing how brokers can be useful in some mechanism design settings. Before describing the example, let us stress that we have already seen that there are social welfare criteria (functionals) that can only be satisﬁed by brokered TC mechanisms. The example below shows that in asymmetric settings we may want to use brokered TC over TTC because of equity considerations.

Consider a manager who assigns n tasks h1,...,hn to n employees i1,...,in with strict preferences over the tasks. The manager wants the allocation to be Pareto efficient with regard to the employees’ preferences. Within this constraint, she would like to avoid assigning task hn to employee in (for instance, this employee may be known to be not as proficient as the other employees in conducting this task). That is, if there is a Pareto-efficient matching that avoids assigning hn to in,shewouldliketochoosesuchamatching.Becauseshedoes not know employees’ preferences, she wants to use a group strategy-proof mechanism. The manager can use one of the Top Trading Cycles mechanisms of Pápai (2000); to do so the manager would need to initially endow employees i1,...,in 1 with all the tasks, and can allow in to inherit some task only after either (i) all other employees are already matched, or (ii) the task is hn is matched. The manager can also use a Trading Cycles mechanism in which in is the permanent broker of hn and every other agent is an owner of one of the remaining tasks. Because the manager’s problem is asymmetric, all mechanisms treat agents in an asymmetric way. We show, however, that the above brokered trading-cycles mechanism is strictly more equitable than any top-trading-cycles mechanism. We compare the equitability of the mechanisms using the equity ranking introduced by Lorenz (1905).38 The outcomes of employees depend of course on the profile of their preferences, and in particular the comparison of the equitability of the mechanisms depends on the preference profile. To get a Lorenz comparison we thus look at many problems that differ only in employees’ preference profiles. We can interpret this as either taking an ex ante view, before the employees drew their rankings from a distribution, or as looking at a population of managers and their employees. We further restrict attention to the canonical case in which all employees rank the tasks in the same way and each ranking is equally likely (or, in the population interpretation, represented by an identical number of managers’ problems).39

38In line with the rest of the paper, we define Lorenz dominance in our ordinal setting. Let us say however that the cardinal analogue of our result in this section is, and its proof is effectively the same. In particular, the best TC mechanism dominates all TTC mechanisms in terms of the Gini coefficient. 39Our result would also be true if we looked at other natural distributions of preference profiles, for instance

36 To formally define Lorenz dominance let us first introduce notation capturing the welfare '[ ˆ ] of agents: given a distribution ˆ over preference profiles, we denote by ⇢ (i, r) the prob- ability that i receives at least his r’th choice object under a mechanism '.Wesaythata mechanism ' Lorenz dominates mechanism for a random preference profile ˆ if for all r =1,..., H there is an ordering of agents i1,...,iI such that for any k =1,..., I we have | | | | | |

k '[ ˆ ] [ ˆ ] min ⇢ (j, r) ⇢ (i`,r) . J I, J =k ✓ | | j J `=1 X2 X The dominance is strict if there are r and k such that the inequality is strict. With these deﬁnitions in place, we can state our concluding result

Proposition 2. In the task assignment problem, the TC mechanisms such that in brokers hn and each agent i` for ` =1,...,n 1 owns h` strictly Lorenz dominates any TTC mechanism satisfying the managers constraints.

AAppendix:RevelationPrincipleforGroupStrategy- Proofness

The classical dominant-strategy revelation principle has a natural extension to group dominant strategies. A group dominant-strategy equilibrium of an indirect mechanism is a pure strategy profile such that for any realization of preferences, when any coalition of agents together report any other messages than the ones prescribed by the original strategy profile, then for any reports of agents outside of the coalition, either at least one of coalition members receives a lower payoffthan he would get or all of the coalition members receive the same payoffs as they would get if the coalition played according to their prescribed strategies. The group dominant-strategy revelation principle says that for any indirect mechanism with a group dominant-strategy equilibrium, there exists a direct group strategy-proof mechanism under which truth-telling achieves the same payoffs for all agents as in this equilibrium of the original mechanism. Its proof is analogous to that of the classical dominant-strategy revelation principle.

BAppendix:CommentsonConsistencyRequirements

This appendix explains the consistency requirements R1-R6. if we restricted attention to proﬁles in which all employees of a manager agreed on a ranking of the tasks.

37 Requirements R1 and R2 are needed to ensure that in Step 1 of the TC algorithm there is always an owned house for the broker to point to. R3 postulates that a broker does not own any houses. Dropping this assumption would violate eﬃciency. For instance, consider the case of two agents 1 and 2 such that agent 1 brokers house h1 and owns house h2 while 2 has no control rights. If agent 1 prefers h1 over h2 while agent 2 prefers h2 over h1 then running the TC algorithm (with the above inconsistent control rights structure) would allocate h2 to agent 1 and h1 to agent 2, which is ineﬃcient. We discussed the role of requirement R4 in Section 4.1. R5 might be called limited persistence of brokerage, and is the counterpart of R4 for brokers. R5 states that a brokerage right persists when we move from smaller to larger submatchings provided two or more owners from the smaller submatching remain unmatched at the larger submatching. The following example illustrates why we need this requirement to keep TC individually strategy-proof:

Example 5. Why do we need R5 to prevent individual manipulation? Consider four agents i1,...,i4.Assumethatattheemptysubmatchingagenti2 brokers a house and other agents own one house each. Denote by hk the house controlled by agent ik.Let us maintain R1-R3, R4, and R6, and violate R5 by assuming that h2 is owned by i4 at submatching (i1,h1) . Now, there are two previous owners unmatched at (i1,h1) , i3 and { } { } i4. Moreover, i2 is no longer a broker. Consider now a preference profile such that h1 is i1’s and i2’s mutual first-choice house, h2 is the first choice of the other agents, and h3 is the second choice of i2 and i3.Underthispreferenceprofileandcontrolrightsstructure,inthe

first round of the TC algorithm, i1 and i2 point to h1, while i3 and i4 point to h2.Househ1 points to its owner i1,andh2 points to its broker i2. There is a unique cycle: h1 i1 h1, ! ! and we obtain the submatching (i1,h1) .Inthesecondround,allremainingagentspoint { } to h2 which is owned by i4.Hencetheuniquecycleish2 i4 h2,andi4 is matched ! ! with h2. Thus, agent i2 is neither matched with his first or second choice. This agent would benefit by misrepresenting his preferences and declaring h3 to be his first choice: then in the

ﬁrst round of TC, he would point to h3 completing the cycle h3 i3 h2 i2 h3 and ! ! ! ! ending up matched to h3,histruesecondchoicehouse.

R6 refers to the case where a broker loses his right at a submatching at which only a single previous owner is unmatched. In this case, the broker requires some protection against losing his right. That is to say, when the previous owner gets matched with the ex-brokered house, the ex-broker owns the houses of this owner. This is the broker-to-heir transition of the ex-broker.

38 The following two examples illustrate why we need R6 to keep TC both individually strategy-proof and non-bossy. The ﬁrst one is similar to the above one:

Example 6. Why do we need R6 to prevent individual manipulation? Consider four agents i1,...,i4.Assumethatattheemptysubmatchingagenti2 brokers h2, i1 owns h1,h4,andi3 owns h3.Atsubmatching (i1,h1) ,assumethati3 owns h2 as well, and i2 { } loses his brokerage right. Now, i4 inherits h4 as an owner. We assume R1-R5, and violate

R6. R5 is not violated, as there is a single previous owner unmatched at (i1,h1) ,andheis { } i3.However,R6isviolated,asatthesubmatching (i1,h1), (i3,h2 , i2 is not the heir to i3. { } That is, i2 does not own the ex-owned house h3 of i3,buti4 does. Consider the preference profile at which agents i1 and i2 have house h1, i3 has h2 and i4 has h3 as their first choices; and agent i2’s second choice is h3. Then, i2 would benefit by ranking h3 first.

Example 7. Why do we need R6 to prevent bossiness? Consider the same control rights structure as in Example 6. Consider the preference profile at which i1 and i3’s first choices are h1,andi2 and i4’s first choices are h3,andi3’s second choice is h2. Now, whether agent i3 reports the above ranking or ranks h2 first, he receives house h2.However,inthe

ﬁrst case, i2 receives h4, while in the latter, he receives h3. Thus, without R6, the mechanism could be bossy.

Example 8. Can we replace R5-R6 by a simpler (and stronger) persistence of brokerage property? Consider the following property “if 0 < I 1 and agent i brokers | | | | house h at and is unmatched at 0 ,theni brokers h at 0 ”(ananalogueofR4for brokers). The following example shows that we cannot replace R5-R6 with this. Consider an environment with four agents, i1,i2,i3,i4,fourhouses,h1,h2,h3,h4, and a TC mechanism c,b whose control rights structure (c, b) is explained below and illustrated by the table in Figure 1.

Houses h1,h3 are owned by agent i1 (denoted by “o” next to i1 in the ﬁgure); he continues owning them as long as he is unmatched (R4 is satisﬁed). When i1 is matched the unmatched of the two houses is owned by i3 (if he is still unmatched). When both i1 and i3 are matched and h1 or h3 is unmatched, the house is owned by i2.Whenallagentsarematchedandone of the houses h1 or h3 is unmatched, the house is owned by i4.

House h2 is owned by i2.Wheni2 is matched but h2 is not then h2 is inherited by one of the unmatched agents; who inherits h2 depends on how the matched agents are matched

39 h1 h2 h3 h4 i1,o i2,o i1,o i4,b

i2 and i3 are matched, and i3,o (i2,h4) otherwise i3,o (i1,h1) .& .&i1 is matched with h2 or h3 i2,o i4,o i1,o i2,o i2,o i4,o i4,o i3,o i3,o i4,o i4,o i4,o i3,o

Figure 1: A control rights structure with broker-to-heir transition

(the submatching). If i1 is matched with h1 and i2 is matched with h4, then the next owners of h2 are i4 and i3, in this order. In all other cases, the order of the next owners of h2 is i1,i3,andi4.

House h4 is initially brokered by agent i4 (denoted by “b” next to i4 in the ﬁgure). Agent i4 continues to broker h4 as long as he is unmatched with two exceptions: (i) if i1 is matched with h1 then i4 loses the brokerage right, and h4 becomes an owned house with the order of owners i2, i4,andi3;and(ii)ifi4 is the only remaining agent, then he owns h4. The second exception is dictated by R2. We explain in detail how the ﬁrst exception occurs and why it is consistent with our conditions. We use the notation of the statement of R6 and denote

= , 0 = (i1,h1) , i = i2, h = h2, i0 = i4, h0 = h4. Now, i4 brokers h4 at and i2 owns h2 ; { } ; at :at0 = (i1,h1) ,asitisallowedbyR5thatonlyone -owner, i2,isleftunmatched, ; { } ; i4 loses his brokerage right of h4. By the second part of R6, at 0 = (i1,h1) , i2,theonly { } remaining -owner, owns h4.Ontheotherhand,atsubmatching(i2,h4) ,bytheﬁrstpart ; { } of R6, i4 owns h2. However, this will only be relevant, when i4 loses his brokerage right.

This happens at 0.Hence,byR4,i4 owns h2 at 0 (i2,h4) = (i1,h1), (i2,h4) . This is [{ } { } what we refer to as the broker-to-heir transition. Let us now check that the TC mechanism defined by this control rights structure is different from all TC mechanisms with consistent control rights structures in which the simple analogue of R4 for brokers holds true: “if 0 < I 1 and agent i brokers house h | | | | at and is unmatched at 0 ,theni brokers h at 0 .” By way of contradiction, let us assume that there is a TC mechanism with a control rights structure satisfying the above strong form of brokerage persistence and produces the same allocation as c,b for each profile of agents’ preferences.

First, notice that at the empty submatching, i4 is the broker of h4 in . This is so because 1 c,b 1 h4 is not owned by any agent at the empty submatching ? as ( [ ]) (h4)=( [ ]) (h4) varies with P (that is, across profiles at which all agents rank h4 first). Hence, there is 2 c,b an agent who has the brokerage right over h4,anditmustbei4,as [ ](i4)= [ ](i4)=g 40 for all P such that all agents rank h4 first and any g h1,h3,h2 second. 2 2{ } Second, consider the submatching = (i1,h1) and a preference profile P such that { } 2 i1 ranks h1 first and other agents rank h4, h3, h2,andh1 in this order. In mechanism , agent i4 would continue to be the broker of h4 at ,andthus

[ ](i )=h . 4 3

However, c,b[ ](i )=h . 4 2 This contradiction shows that indeed the TC mechanism of the example cannot be represented by a control rights structure in which brokerage satisﬁes the analogue of R4 for brokers (in particular it cannot be represented without brokers).

CAppendix:ProofoftheParetoEﬃciencyofTCMech- anisms (Part 1 of the Proof of Theorem 2)

We prove the proposition by a simple recursion. Consider the TC algorithm. Each agent matched in the first round of the algorithm gets his first or second choice house and is matched with a house controlled by an agent matched in the same round. Moreover, there is at most one agent who gets his second choice in the first round, as there is at most one broker. Therefore, if an agent matched in the first round gets his second choice, then getting his first choice would harm another agent matched in that round. In general, each agent matched in the r-th round of the algorithm gets his first or second choice among the remaining houses and is matched with a house controlled by an agent matched in the same round. Moreover, there is at most one agent who gets his second choice in this round, as there is at most one broker. Therefore, if an agent matched in the r-th round were given a better house, this would harm some other agent matched at the same or an earlier round. QED

DAppendix:ProofoftheIndividualStrategy-Proofness of TC Mechanisms (Part 2 of the Proof of Theorem 2)

Let c,b be a TC mechanism. Let be a preference profile. We fix an agent i I. We will 2 show that i cannot benefit by submitting i0 = i when the other agents submit i.Lets 6

41 be the round i leaves (with house h)under i and s0 be the time i leaves (with h0)under 0 i in the algorithm. We will consider two cases.

Case 1. s s0: At round s,thesamehousesandagentsareinthemarketunderboth i  and 0 by Lemma 4. If i is not a broker at time s under i,then,bysubmitting i,agenti i gets the top-choice house among the remaining ones in round s,implyingthathecannotbe better offby submitting 0 . i Assume now that i is a broker at time s under i.Lete be the brokered house at time s.Ife is not agent i’s top-choice house remaining under i,thenbysubmitting i,agenti gets the top-choice house among the remaining ones in round s,implyingthathecannotbe better offby submitting 0 . i It remains for us to consider the situation in which e is broker i’s top-choice remaining house, and to show that i cannot get e by submitting the profile 0 .Foranargumentby i contradiction, assume that under 0 agent i leaves at round s0 with house e.Becauseagent i i is a broker when he leaves at i,thereisanagentj who is matched with house e at time s.Atthistime,j is an owner of some owned house hj, and e is his top-choice house. By

Lemma 4, the control rights structure at round s is the same under both i and 0 .Hence, i i is also a broker at time s after submitting 0 , and j is an owner of hj. Moreover, j’s top i choice is still house e. That means that under 0 agent j will stay unmatched until s0 +1. i Since agent i leaves with e at s0,hecannotbethebrokerofe at this round, because a broker cannot leave with the brokered house, while another owner j is unmatched. Thus, there is a round s00 s +1,...,s0 at which agent i stops being the broker of e.Sincee is still 2{ } unmatched at this round, there is a broker-to-heir transition between s00 1 and s00 (by R6). Because j is an owner of hj at both s00 1 and s00,hewouldhaveinheritede at s00 (by R6). Thus, j would have left with e at s00, as e is j’s top choice among houses left at s (and hence those left at s00). A contradiction.

Case 2. s>s0: At round s0,thesamehousesandagentsareinthemarketunderboth

i and 0 by Lemma 4. Consider round s0 under both i and 0 .Under 0 , agent i points i i i 1 1 n to house h0 = h that points to agent i that points to ... that points to object h that n points to agent i = i (and this cycle leaves at round s0). If the cycle is trivial (n =1)and h0 points back to i,theni owns h0. Since ownership persists by R4, i will own h0 at s>s0, and thus at round s, agent i would leave with a house at least as good as h0. In the sequel, assume that there is at least one other agent in in the cycle (that is, n 2). ` ` 1 1 If each house h is owned by i ,forall` 1,...,n ,thenthechainh0 = h i 2{ } ! ! h2 ... hn i will stay in the system as long as i is in the system (by persistence of ! ! ! ownership, implied through R4). Thus, at round s agent i would leave with a house at least

42 as good as h0 under i. ` ` 1 1 2 n If i brokers h for some ` 1,...,n ,thenthechainh0 = h i h ... h i 2{ } ! ! ! ! ! will stay in the system as long as i` continues brokering h` (since there are no other brokerages ` ` and ownerships persist by R4). If i brokers h at round s under i,thenwearedone,since the same cycle would have formed. Thus suppose that at a round s00 s0 +1,...,s broker 2{ } ` `+1 i loses his broker status. Because n 2,agenti is an owner at both rounds s00 1 and s00. Hence, the loss of brokerage status means that i` enters a broker-to-heir transition. We must then have n =2(since by R5, only one previous owner can remain unmatched during the broker-to-heir transition). There are two cases, as by R6’s second part, the unique previous owner owns both houses, his previously owned house and the ex-brokered house: either i1 1 2 2 ` 2 1 2 owns h = h0 and h (and i = i is the heir) or i = i owns h = h0 and h .Intheformer 1 2 2 1 case, i who wants h , will leave with it in round s00 under i,andi = i will inherit h = h0 at s00 +1by R6, more precisely, by the broker-to-heir transition property. In the latter case, 1 1 i = i owns h = h0 already in round s00.Inbothcases,inrounds s00 agent i can only leave with a house at least as good as h0 under i. QED

EAppendix:ProofoftheNon-BossinessofTCMecha- nisms (Part 3 of the Proof of Theorem 2)

c,b Let be a TC mechanism. Fix an agent i I and two preference proﬁles =[ i , i ] ⇤ 2 ⇤ ⇤ and 0=[ i0 , i ] such that ⇤ ⇤

c,b c,b h = [ 0](i )= [ ](i ). ⇤ ⇤ ⇤

Let s be the round i leaves (with house h )submitting i and s0 be the time i leaves ⇤ ⇤ ⇤ ⇤ (with h )submitting i0 .Bysymmetry,itisenoughtoconsiderthecases s0.Inorder ⇤ ⇤  to show that c,b c,b [ ](i)= [ 0](i) i I, 8 2 we will prove the following stronger statement:

Hypothesis: If a cycle h1 i1 h2 ... hn in h1 of length n 1, 2,... forms ! ! ! ! ! ! 2{ } and is removed at round r under preference proﬁle ,thenunderpreferenceproﬁle 0 one of the following three (non-exclusive) cases obtains:

1. the same cycle h1 i1 h2 ... hn in h1 forms; or ! ! ! ! ! !

43 2. n =2and two cycles form:

cycle h1 i2 h1 or cycle g i2 h1 i g for some agent i and some • ! ! ! ! ! ! house g,and cycle h2 i1 h2 or cycle h i1 h2 j h for some agent j and some • ! ! ! ! ! ! house h;

3. n =1and there exists an agent j = i1 and a house h = h1 such that the cycle 6 6 h i1 h1 j h forms. ! ! ! ! Whenever in the proof we encounter cycles of length n,thesuperscriptsonhousesandagents n+1 1 n+1 1 s 1 will be understood to be modulo n,thatisi = i and h = h .By [ ] we denote the submatching of agents and houses matched before round s of c,b when agents submitted preference proﬁle .Werefertocyclesformedunder as -cycles, and to cycles formed under 0 as 0-cycles. By Lemma 4, the above hypothesis is true for all r

Initial step. Consider r = s.Under , house h1 points to agent i = i1 points to house ⇤ ⇤ ⇤ h = h2 that points to agent i2 that points to ... that points to agent in that points to house ⇤ ⇤ ⇤ ⇤ h1, and the cycle ⇤ h1 i1 h2 ... hn in h1 ⇤ ! ⇤ ! ⇤ ! ! ⇤ ! ⇤ ! ⇤ is removed in round s.Lemma4impliesthatthesamehousesandagentsareinthemarket 1 n at time s under both and 0 and that all agents from Is[ ] i ,...,i are matched by { ⇤ ⇤ } s s 2 n [ 0] in the same way as in [ ].Lemma4alsoimpliesthatthechainh ... h ⇤ ! ! ⇤ ! n 1 1 i h i forms at round s under preferences 0. ⇤ ! ⇤ ! ⇤ If all pairs (i` ,h` ),forall` 2,...,n , consist of an owner and an owned house at s[ ], ⇤ ⇤ 2{ } s 2 n then they consist of an owner and an owned house at [ 0] and the chain h ... h ⇤ ! ! ⇤ ! n 1 1 1 i h i will stay in the system as long as i is in the system (by R4). Thus, at s0 all ⇤ ! ⇤ ! ⇤ ⇤ agents i1,...,in would leave in the same cycle as under .Noticethatthisargumentfully ⇤ ⇤ covers the case n =1. If n>1 and i` brokers h` for some ` 2,...,n ,thenthechainh2 ... hn ⇤ ⇤ 2{ } ⇤ ! ! ⇤ ! in h1 i1 will stay in the system as long as i` continues to broker h` .Ifi` continues to ⇤ ! ⇤ ! ⇤ ⇤ ⇤ ⇤ ` broker h until round s0 under %0, then the initial step is proved. Otherwise, there is a round ⇤ ` ` s00 s +1,...,s0 such that agent i has the brokerage right over h at rounds s, ..., s00 1 2{ } ⇤ ⇤

44 `+1 ` but not at round s00.ByR6’sbroker-to-heirtransitionproperty,n =2and i owns h at ⇤ ⇤ s `+1 s 1 s `+1 00 [ 0] because he owns h at both 00 [ 0] and 00 [ 0].Asi ’s top preference is then ⇤ ⇤ ` h , he leaves with it at s00.Applyingagainthebroker-to-heirtransitionproperty,weseethat ⇤ ` `+1 agent i inherits h at s00 +1and will be matched with it. This case ends the proof of the ⇤ ⇤ inductive hypothesis for r = s.

r r 1 Inductive step. Now, take any round r>ssuch that [ ] [ ] is non-empty, and assume that the inductive hypothesis is true for all rounds up to r 1. Consider agents and houses h1 i1 h2 ... hn in h1 ! ! ! ! ! ! that form a cycle of length n 1 at round r under .Sinceallagentsbuti⇤ (who is matched 1 n before round r)havesamepreferencesinbothproﬁles and 0,sodoagentsi ,...,i .We start with two preparatory claims.

Claim 1. (i) If agent j and house h are unmatched at submatchings ,0,andj controls h at but not at 0,thenj brokers h at .(ii)If,additionally,agentj0 and house h0 are [ unmatched at submatchings ,0,and,at0,agentj controls h and agent j0 owns h0,then j = j0, j0 owns h and h0 at 0,andj brokers h at 0 and owns h0 at 0 (j0,h) . 6 [ [ [{ } Proof of Claim 1: The ﬁrst statement follows from R4. To prove the second statement, ﬁrst notice that R4 implies that j brokers h at 0,andhencej = j0.R4furthermoreimplies 6 that j0 owns h0 at all submatchings between 0 and 0.Sincej stops brokering h at a [ submatching between 0 and 0,assumptionR6impliesthatj0 owns h at 0,andj [ [ owns h0 at 0 (j0,h) . QED [ [{ }

Claim 2. Under 0: all houses i` prefers over h`+1,exceptpossiblyh`, are matched with agents other than • i`;

` r 1 ` `+1 if i is a ( )-owner then all houses i prefers over h are matched with agents • other than i`.

` r 1 Proof of Claim 2: Consider the run of the algorithm under 0.Ifi is [ ]-owner then all houses i` prefers over h`+1 are matched before round r under . The inductive assumption ` ` thus implies that they are also matched with agents other than i under 0.Similarly,ifi 45 r 1 ` `+1 ` is [ ]-broker then all houses i prefers over h ,exceptpossiblyh ,arematchedbefore round r under , and the inductive assumption yields the claim. QED

In the remainder of the proof, we use the following notation: 1 n t is the earliest round one of the houses h ,...,h is matched under 0; `+1 h is a house matched in round t under 0, `+1 `+1 t 1 j is the agent controlling house h at [ 0],and r 1 t 1 ⌫ = [ ] [ 0]. [ `+1 `+1 `+1 `+1 t 1 If j = i ,thenagenti controls h at [ 0]. Three cases are possible: `+1 `+1 r 1 If n =1,theni owns h at [ ],andbyR4at⌫,aswell.First,letusnow • `+1 `+1 t 1 show that i cannot broker h at [ 0].Ifhedoesthenthereexistssomeagent t 1 `+1 `+1 j that owns a house h at [ 0] so that h j h i is part of the cycle ! ! ! `+1 `+1 t 1 occurring in round t under 0. Moreover, i loses brokerage of h between [ 0] and ⌫,andbyR6,j owns h`+1 at ⌫ contradicting i`+1 owning h`+1 at ⌫. Thus, i`+1 `+1 t 1 `+1 owns h at [ 0], and, by Claim 2, he points to h and is matched with it. The inductive hypothesis is correct for the cycle.

If n 2 and i`+1 prefers h`+2 over h`+1, then by Claim 2, he points to it (he cannot • broker it since he controls h`+1), and house h`+1 is matched in a cycle that contains h`+1 i`+1 h`+2 .... ! ! ! `+1 `+1 `+2 `+1 `+1 r 1 If n 2 and i prefers h over h ,theni is the broker of h at [ ]. • `+1 `+1 t 1 First, let us show that i cannot own own h at [ 0]. If he does then he owns it `+1 `+1 r 1 at ⌫, as well. Then i loses brokerage of h between [ ] and ⌫.R5impliesthat r 1 ` there is at most one other [ ]-owner left unmatched at ⌫,andi is that owner. R6 implies that i` should own h`+1 at ⌫,acontradiction.Hence,i`+1 brokers h`+1 at t 1 `+1 `+2 `+1 `+1 [ 0]. By Claim 2, i points to h (as he cannot point to h ), and house h is matched in a cycle that contains h`+1 i`+1 h`+2 .... ! ! ! We can conclude that j`+1 = i`+1,ortheinductivehypothesisistrueforthecycleofi1,...,in, 6 `+1 `+1 `+1 `+2 or that the cycle of h at 0 contains h i h .... ! ! ! In the last of these three possibilities, let us deﬁne j`+2 to be the agent controlling h`+2 t 1 `+2 at [ 0],andrepeattheaboveprocedureforh .Inthisway,repeatingthisprocedure, we either show that the cycle

h`+1 i`+1 h`+2 ... i` h`+1 ! ! ! ! !

46 leaves at round t under 0 (and the inductive hypothesis (part 1) is true for this cycle), or there is k such that i`+k = j`+k. 6 To complete the proof it is enough to consider the latter case. Without loss of generality, 1 1 1 1 t 1 1 we may assume that ` + k =1(modulo n). Then, j = i , j controls h at [ 0],andh 6 1 n t 1 is matched in round t under 0. By Claim 2, all agents i ,...,i are unmatched at [ 0] because all houses h1,...,hn are. Thus, all these agents and houses are unmatched at ⌫. Consider three cases.

1 1 r 1 Case n =1. Then, agent i owns h at [ ],andbytheinductiveassumption,hegetsat 1 1 most house h under 0. Thus, i is unmatched in round t. Consider two subcases depending 1 r 1 on whether j is matched at [ ] or not. 1 1 j Ir 1[ ]. Then the inductive assumption and h / Hr 1[ ] imply that • 2 2 ? there exists house h = h1 such that j1 is matched before round r in a cycle 6 h j1 h under ,and ! ! ? there exists agent i such that the cycle h i h1 j1 h is matched at ! ! ! ! round t under 0 .

Notice that i Ir 1[ ], as otherwise the inductive assumption implies that i is matched 62 1 1 1 with h under ,contrarytoh Hr 1[ ]. Thus both i and i are unmatched at ⌫, 62 1 t 1 and Claim 1 implies that either i = i ,ori is a broker of h at [ 0].Inthelatter 1 1 t 1 1 1 case, R1 implies that j is an owner of h at [ 0],andR4impliesthatj owns h at 1 1 1 1 r 1 ⌫ contrary to j = i and i owning h at [ ],andhenceat⌫. This contradiction 6 shows that i1 = i,andhencethattheinductivehypothesis(part3)istruefori1.

1 1 1 j / Ir 1[ ]. Then, both agents j and i are unmatched at the submatching ⌫,and • 2 1 1 t 1 Claim 1 implies that j is a broker of h at [ 0].Letj0 be an agent who obtains 1 1 1 t 1 1 h at time t under 0.Asj is a broker of h at [ 0],wehavej0 = j . Thus j0 is 6 t 1 1 an owner of a house h0 at [ 0],andh0 = h . 6 r 1 Agent j0 is unmatched at [ ] because if he were matched then the inductive 1 r 1 assumption would imply that h is matched at [ ], which is false. Now, if h0 r 1 was matched at [ ] then the inductive assumption would imply that either all r 1 agents in the 0-cycle of h0 are unmatched at [ ] (which is false), or h0 is matched under 0 in a cycle of one or two agents. Since the 0-cycle of h0 contains at least two 1 1 diﬀerent agents j and j0,wewouldconcludethatj obtains h0 under 0,andhenceby 1 r 1 the inductive assumption j would be matched with h0 in [ ].Sinceweconsider 1 r 1 the situation j / Ir 1[ ],wemayconcludethath0 is unmatched at [ ]. Thus j0 62 47 r 1 and h0 are unmatched at [ ],andhenceat⌫. Then, R4, R5, and R6 imply that 1 1 1 1 j0 owns h at ⌫,andthusj0 = i .Sincei points to h ,theyarematchedinthecycle 1 1 1 h0 i h j h0,andtheinductivehypothesis(part3)istruefori . ! ! ! !

1 1 r 1 2 r 1 2 Case n>1 and i brokers h at [ ]. Then, agent i is the [ ]-owner of h .We will show that in this case n =2,andtheinductivehypothesis(part2)holdsforthe -cycle of h1, i2, h2,andi1.

1 0 0 1 1 Step 1. First, consider how h is matched under 0.Leth j h j be part of ! ! ! 1 0 1 the cycle of h in round t under 0 (this is without loss of generality as we allow h = h 0 1 0 r 1 and j = j ). By the inductive assumption, j is unmatched at [ ],andoneofthetwo subcases obtains: 1 r 1 (a) all other houses and agents in the cycle of h under 0 are unmatched at [ ],or 0 0 1 1 0 1 0 (b) the cycle h j h j h occurs under 0 and j is matched with h in ! ! ! ! r 1 1 0 r 1 [ ],i.e., (j ,h ) [ ]. { }✓ We handle these two subcases separately:

Subcase (a): Two further subcases are possible depending on whether j1 brokers h1 at • t 1 [ ] or not: 1 1 t 1 0 1 0 1 0 0 ? Assume j brokers h at [ 0]. Then, j = j , h = h ,andj owns house h at 6 6 t 1 1 1 t 1 r 1 [ 0]. Either, j or i exits brokerage between [ 0] or [ ],respectively, and ⌫,asbothofthemcannotbrokeritat⌫. Depending on whether j1 or i1 loses the brokerage right, R5 implies that there are only two agents in the cycle of h1 0 n 1 under 0 or ,respectively;moreover,byR6,j or i (respectively) owns h at ⌫.However,thenneitherj1 nor i1 can broker h1 at ⌫,implyingthatbothlose brokerage rights, and hence, h1 is owned by both j0 and in at ⌫. Thus, j0 = in, 2 1 and n =2.Weconcludethati is matched with h under 0 and the cycle he gets matched in has two agents, i.e., h0 i2 h1 j1 h0. ! ! ! ! 1 1 t 1 1 1 ? Assume j owns h at [ 0]. Then, R4 implies that j owns h at ⌫. Thus, 1 r 1 i loses his brokerage right between [ ] and ⌫.ByR5,therecouldbeat r 1 n 2 most one [ ]- owner still not matched at ⌫.Hence,n =2and, i = i is the remaining owner. By R6, h1 is owned by i2 at ⌫.Sinceh1 is also owned by j1 at 1 2 1 2 ⌫,wehavej = i . By Claim 2, h is the best house that i can get under 0. 1 1 2 1 Therefore, the cycle of h in round t under 0 is h i h . ! ! t 1 0 0 t 1 Subcase (b): Since at ( 0) agent j controls h ,R6impliesthatat [ 0] • [ (j1,h0) ,agentj0 owns h1. By R4, this agent still owns h0 at ⌫. Thus, i1 leaves { } 48 1 r 1 2 2 r 1 2 the brokerage of h between [ ] and ⌫.Asi owns h at [ ],byR5,i is the only previous owner unmatched at the submatching at which i1 leaves brokerage. Thus, the cycle of h1 under includes only two agents i1 and i2,i.e.,n =2. Moreover, 2 1 2 0 1 R6 and R4 imply that i owns h at ⌫. Thus, i = j ,andthecycleofh at 0 is h0 i2 h1 j1 h0. ! ! ! ! Either subcase proves that there are two agents in the cycle of h1 under ,i.e.,n =2,and the inductive hypothesis (part 2) holds for i2 and h1.

2 r 1 1 1 2 Step 2. Next, consider how h is matched under 0.Since,at ( ), i controls h and i controls h2,R6impliesthati1 owns h2 at ⌫ (i2,h1) .Lett1 be the round in which i1 is [{ } 2 2 1 2 matched and t be the round in which h is matched under 0.Sinceh is matched with i 1 1 2 2 2 2 and not i under 0, Claim 2 implies that t t . Moreover, t t.Supposej0 h j ! ! 2 2 is part of the cycle of h in round t under 0.Let

2 r 1 t2 1 2 1 ⌫ = [ ] [ 0] (i ,h ) . [ [{ }

We have ⌫ ⌫2. Thus, by R4, i1 owns h2 at ⌫2.Weconsidertwosubcases:i1 = j2 and ✓ i1 = j2. 6 1 2 1 2 t2 1 1 2 Assume i = j . First consider the case i brokers h at [ 0]. Then i = j = j0, • 6 t2 1 r 1 and j0 is an owner at [ 0].Agentj0 is not matched at [ ], as otherwise 2 r 1 the inductive assumption would imply that h is matched at [ ],acontradiction. 2 1 2 Hence, j0 is not matched at ⌫ . Moreover, i loses brokerage right of h between t2 1 2 2 2 2 1 [ 0] and ⌫ , as he owns it at ⌫ .ByR6,j0 owns h at ⌫ ,contradictingi owning 2 1 2 t2 1 1 2 it at ⌫ .Wecanconcludethati owns h at [ 0].Sinceh is matched with i 1 2 1 2 and not i under 0, Claim 2 implies that h i h is the cycle under 0, showing ! ! that the inductive hypothesis (part 2) holds true for i1 and h2.

1 2 2 Assume i = j . By the inductive assumption, j0 is unmatched at ⌫ ,andeither • 6 2 r 1 (a) all other houses and agents in the cycle of h under 0 are unmatched at [ ], or

2 2 2 (b) the cycle h0 j0 h j h0 occurs under 0 and j is matched with h0 in ! ! ! ! r 1 2 r 1 [ ] ,i.e., (j ,h0) [ ]. { }✓ 1 2 2 2 2 t2 1 ? Subcase (a): As i owns h at ⌫ ,R4impliesthatj is the broker of h at [ ], t2 1 2 2 and he loses this brokerage right between [ 0] and ⌫ .Hence,j0 = j and 6 2 2 by R5, there are no other agents than j and j0 in the cycle of h under 0.By

49 2 2 1 2 R6 and R4 j0 owns h at ⌫ . Thus, j0 = i .Hence,thecycleofh under 0 is 1 2 2 h0 i h j h0 . ! ! ! ! t2 1 t2 1 ? Subcase (b): Since at ( 0) agent j0 controls h0,R6impliesthatat [ 0 2 2 2 2 2 1 2 ] (j ,h0) ⌫ , j0 owns h .ByR4,j0 owns h at ⌫ .Recallthati owns h at [{ }⇢ 2 1 2 1 2 2 ⌫ . Then i = j0,andthecycleofh under 0 is h0 i h j h0. ! ! ! ! Either subcase proves that the inductive hypothesis (part 2) holds for i1 and h2.

1 1 r 1 1 1 Case 3 . n>1 and i owns h at [ ] (in particular, R4 implies that i owns h at ⌫). We will show that this case cannot happen. By the inductive assumption either 1 r 1 (a) all agents in the 0-cycle of h are unmatched at [ ] or 0 0 1 1 0 0 (b) n =2and the cycle h j h j h occurs under 0 for some house h , ! ! ! ! 1 0 r 1 1 0 r 1 and j is matched with h in [ ],thatis (j ,h ) [ ]. { }✓ 1 1 t 1 Subcase (a): By R4, agent j is the broker of h at [ 0] and loses this right between • t 1 0 1 0 0 0 1 1 [ 0] and ⌫.Hence,j = j owns a house h such that h j h j is part 6 ! ! ! 1 1 1 of the cycle of h under 0.Asj loses the brokerage right of h ,byR5therecanbe at most one other agent in this cycle, and hence the cycle is h0 j0 h1 j1 h0. ! ! ! ! 0 1 0 1 1 1 R6 implies that j owns h at ⌫,hencej = i . Then i gets h under 0 in round t. 1 r 1 t 1 However, as i is both a [ ]-owner and a [ 0]-owner, Claim 2 implies that he 2 1 would point to h not h under 0 in round t,acontradiction. t 1 0 0 0 1 Subcase (b): Since at ( 0) agent j controls h ,R6impliesthatj owns h at • t 1 1 0 0 r 1 [ 0] (j ,h ) .Furthermorej is unmatched at [ ], as otherwise the in- [{ } ductive assumption would imply that h1 is matched at this submatching contrary to 1 r 1 0 h being unmatched at [ ]. Thus, j is unmatched at ⌫, and, by R4, he owns 1 t 1 1 0 1 1 0 1 h at ⌫ [ 0] (j ,h ) .Asi also owns h at ⌫,wehavej = i . Thus, ◆ [{ } 0 1 1 1 0 1 1 r 1 h i h j h is the cycle of h under 0.Butweknowthati (a [ ]- ! ! ! ! 2 1 2 t 1 1 owner) prefers h over h .Becauseh is unmatched at [ 0],itmustbethati brokers h2 at this submatching. Thus, h0 = h2. This contradicts the fact that h0 is 2 r 1 matched and h is unmatched at [ ]. Either subcase leads to a contradiction showing that Case 3 cannot happen. This completes the proof of the inductive hypothesis. QED

50 FAppendix:ProofoftheImplementationPartofThe- orem 2 (Part 4 of the Proof of Theorem 2)

Let ' be a group strategy-proof and Pareto-efficient mechanism (fixed throughout the proof). We are to prove that ' may be represented as a TC mechanism. We will first construct the candidate control rights structure (c, b) and then show that the induced TC mechanism c,b is equivalent to '. Let us start by introducing some useful terms and notation. Let , n 0, 2 M 1 2 n 1 n h ,h ,...,h H,andi I.DenotebyPi[, h ,...,h ] the set of preferences i of agent i 2 2 such that

if i I, then • 2 (i) i g for all g H (i) , 2 { }

if i I, then • 2

1 2 n 1 n h i h ... i h i g i g0 for all g H h ,...,h and all g0 H. ⌫ ⌫ ⌫ 2 2 1 n That is, if i is not matched in submatching then Pi[, h ,...,h ] is the set of preferences that rank h1,...,hn in this order and above all other houses unmatched under ,andrank 1 n those houses above all houses matched under .Ifi is matched under then Pi[, h ,...,h ] is the set of preferences that rank agent i’s match under over all other houses. Observe that Pi[?] Pi. ⌘

1 n 1 n Let P[, h ,...,h ] P be the Cartesian product of Pi[, h ,...,h ] over all i I.We ✓ 2 deﬁne

P⇤[, h]= h H h P[, h, h0], [ 02 { } i.e., the set of preference proﬁles generated by P[, h] that rank the same house as the second choice across all agents unmatched under .

1 n 1 n When is fixed, we will occasionally write h ,...,h ,... instead of Pi[, h ,...,h ]. h i We are ready to introduce some new terminology for the mechanism ' that is similar to the control rights structure terminology of the TC mechanisms. To distinguish the two classes defined for TC and ', we will suffix these new definitions with *. 1 Ahouseh H is an owned* house at if '[ ] (h)=i for all P[, h] for 2 2 M 2 some i I;werefertoi as the owner* of h at . 2

51 Ahousee H is a brokered* house at if there exist some and 0 P⇤[, e] 2 2 M 2 1 1 such that '[ ] (e) = '[ 0] (e).Agentk is the broker* of e at if e is a brokered* 6 house at and for all P⇤[, e] house '[ ](k) is the second choice of k in k.Observe 2 that a house cannot be both owned* and brokered* at the same submatching. 40

Notice that if ' is a TC mechanism and i is an owner at then i is an owner* at ,and similarly for the broker*. Thus, owners* and brokers* are the candidate owners and brokers in the TC mechanism that we will construct. We will show that the starred terms can be used to determine a consistent control rights structure (c, b) and a TC mechanism c,b. The proof of Theorem 2 will be ﬁnished after we show that ' = c,b.

Two lemmas proved in Pápai (2000) will be useful. Following her deﬁnition, we say that j envies i at if '[ ](i) '[ ](j). j

Lemma 5. (Pápai 2000) For all i, j I,all P,andall ⇤ Pj,ifj envies i at and 2 2 j 2 '[ j⇤, j](i) = '[ ](i),then 6

'[ ](i) i '[ j⇤, j](i).

Lemma 6. (Pápai 2000) For all i, j I,all P,andall ⇤ Pj, if j envies i at and 2 2 j 2 '[ j⇤, j](i) = '[ ](i),thenthereexists i⇤ Pi such that 6 2

'[ i⇤, j⇤, i,j ](i)='[ ](j). { }

This last lemma allows us to prove

Lemma 7. For all i, j I,all P,andall ⇤ Pj,ifj envies i at ,then 2 2 j 2

'[ j⇤, j](i) i '[ ](j). ⌫

Proof of Lemma 7. If '[ j⇤, j](i) = '[ ](i) then the lemma follows from Lemma 6 and 6 strategy-proofness of '.If'[ j⇤, j](i)='[ ](i) then Pareto eﬃciency of ' ( ) implies that i cannot envy j when j envies i and hence the claim of the lemma follows. QED

40It may appear from the deﬁnitions that there is a third option for an unmatched house besides being owned* and brokered* at a submatching. However, Proposition 3 below shows that these are the only two options.

52 F.1 The Starred Control Rights Structure is Well Deﬁned

The main result in this subsection (Proposition 3) shows that any house is either owned* or brokered*. Thus, the starred (candidate) control rights structure is well deﬁned. We build up toward this result through several lemmas. All lemmas in this section are formulated and proven at a ﬁxed submatching . 2 M

Lemma 8. Let .Foralli I and all h H, 2 M 2 2

'[ ](i)=(i) for all P[, h]. 2

Proof of Lemma 8. Suppose that an agent in i I does not get (i) at '[ ]. Then we 2 can create a new matching by assigning all agents in I that get a house in H ahousein

H that was assigned to an agent in I,allotheragentsj in I the house '[ ](j),andall agents j in I the house (j).SinceeachagentinI ranks houses in H lower than houses in H and each agent in I ranks his -house as his ﬁrst choice, this new matching Pareto dominates '[ ],contradictingthefactthat' is Pareto eﬃcient. QED

Lemma 9. Let and e, h H.Thenthereexistssomeagenti I such that 2 M 2 2 '[ ](i)=e for all P[, e, h]. 2

Proof of Lemma 9. By way of contradiction suppose that , 0 P[, e, h] are such that 2 '[ ](i)=e = '[ 0](i) for some agent i I.Withoutlossofgenerality,weassumethat 6 2 and 0 diﬀer only in preferences of a single agent j I.Letg = '[ ](j).Bystrategy- 2 proofness for j,wehavej = i and g = e. Moreover, by Maskin monotonicity, if it were true 66 6 that g = h,then'[ 0]='[ ] would be true, contradicting that '[ 0] = '[ ]. Thus, g = h. 6 6 We may further assume that

e, h, g, ... P [, e, h], i2h i✓ i as Maskin monotonicity for i implies that ' ( ) does not depend on how i ranks houses below e,andstrategy-proofnessfori implies that we still have e = '[ i, 0 i](i)='[ 0](i). 6 Let g0 = '[ 0](j).Bynon-bossiness,g0 = g and by strategy-proofness g0 = e, h. Maskin 6 6 monotonicity for j allows us also to assume that

j e, h, g, g0,... and 0 e, h, g0,g,.... . 2h i j2h i

Let i0 I be the agent who gets e at 0,andk I be the agent who gets h at . 2 2 Notice that such agents exist because of Pareto eﬃciency. Because neither i nor j gets e at

53 0,wehavei0 = i, j.Furthermore,wesawabovethatj does not get h at ,andLemma5 6 implies that neither i nor i0 gets h at . Thus k = i, i0,j. 6 Claim 1. (1) Under ,agentsi, j, k are matched with houses as follows

'[ ](i)=e, '[ ](j)=g, and '[ ](k)=h

(2) Under 0,agentsi0,j,k are matched with houses as follows

'[ 0](i0)=e, '[ 0](j)=g0,'[ 0](i)=g, and '[ 0](k)=h.

Proof of Claim 1. The ﬁrst ﬁve equalities were proved or assumed above and are listed for convenience only. The last two equalities require an argument. First, let us show that

'[ 0](i)=g.Sinceagentj envies i at and '[ ](j)=g,Lemma7impliesthati gets at least g at 0= j, j0 .Hence,'[ 0](i) h, g . Furthermore, Lemma 5 tells us that j 2{ } cannot envy i at 0.Hence,'[ 0](i)=g. Second, let us show that '[ 0](k)=h. Consider an auxiliary preference ranking ˜ k 2 e, h, g, ... that agrees with k except possibly for the relative ranking of g. Maskin mono- h i tonicity implies that

' ( ˜ k, k)=' ( ) .

Thus, agent j envies k at ( ˜ k, k) and '[ ˜ k, k](j)=g,andthusLemma7implies that '[ ˜ k, k,j, j0 ](k) k g.Strategy-proofnessfork implies that k cannot get e at ⌫ ˜ k, k,j, j0 .Toprovethatk gets h it is thus enough to show that i gets g at ˜ k, k,j, j0 . The proof is analogous to the proof of the equality '[ 0](i)=g above: i gets at least g at ˜ k, k,j, j0 ,andbecausej cannot envy i at ˜ k, k,j, j0 (by Lemma 5), we must have '[ ˜ k, k,j, j0 ](i)=g. We have thus shown that '[ ˜ k, k,j, j0 ](k)=h,andby Maskin monotonicity it must be that '[ ˜ k, k,j, j0 ]='[ k, k,j, j0 ]='[ 0]. Thus, '[ 0](k)=h, and the claim is proved. QED The above claim and Maskin monotonicity, allows us to assume in the sequel that

e, h, g, ... . k2h i

54 Let us also ﬁx three auxiliary preference rankings for use in the subsequent analysis:

⇤ h, e, g, ... , i 2h i ⇤ h, e, ... , and i0 2h i ⇤ e, g, h, ... . k2h i

We will prove a number of claims.

Claim 2. (1) '[ i⇤, i](i)=h and '[ i⇤ , 0 i ](i0)=h. 0 0 (2) '[ i⇤, i](j)=g. Proof of Claim 2.

(1) By strategy-proofness for i, '[ i⇤, i](i) i⇤ e. Everybody else in I ranks e over ⌫ h. Thus, by Lemma 8 and Pareto eﬃciency, i should get h at [ i⇤, i]. The symmetric argument yields '[ i⇤ , 0 i ](i0)=h. 0 0 41 (2) By Maskin monotonicity for i, '[ i⇤, 0 i]='[ 0]. Thus, j gets g0 at [ i⇤, 0 i]. By strategy-proofness for j,agentj gets at least g0 and no house better than g at [ i⇤, i] (recall that between i and 0 i only j changes preferences). Thus, in order to prove the claim that j gets g at [ i⇤, i] it is enough to show that he cannot get g0 at [ i⇤, i]. Assume to the contrary that j gets g0 at [ i⇤, i]. Then, non-bossiness would imply that i gets h at [ i⇤, 0 i].Bystrategy-proofnessfori,hegetsatleasth at 0.Butthenj envies i both at and 0= j0 , j and by Lemma 5, i must get the same house at these two proﬁles. This contradiction proves Claim 2. QED

Claim 3. (1) '[ k⇤, k](k)=g. (2) '[ k⇤, 0 k]='[ k⇤, k]. Proof of Claim 3. (1) Because k gets h at ,strategy-proofnessimpliesthatk cannot get e and gets at least h at [ k⇤, k]. Thus, k gets h or g at [ k⇤, k]. Everybody else in I ranks h over g. Thus, by Lemma 8 and Pareto efficiency, agent k should get g at [ k⇤, k]. (2) Profiles [ k⇤, 0 k] and [ k⇤, k] differ only in preferences of agent j who ranks g above g0 at j and the other way at 0 .Weestablishedinpart(1)thatj does not get g at j [ k⇤, k]. Maskin monotonicity for j implies '[ k⇤, 0 k]='[ k⇤, k]. QED

Claim 4. '[ k⇤, k](i)=e and '[ k⇤, k](i0)=h. 41We use this short-hand terminology often: When we say “by Maskin monotonicity for an agent i, '[ i⇤, 0 i]='[ 0]”wemeanthatas'[ 0](i) i0 a = '[ 0](i) i⇤ a for all houses a, [ i⇤, 0 i] is a ) '-monotonic transformation of 0 ,andbyMaskinmonotonicityof', '[ i⇤, 0 i]='[ 0].

55 Proof of Claim 4. Because agent k envies agent i at ,Lemma7impliesthati gets at least h = '[ ](k) at [ k⇤, k].Hence'[ k⇤, k](i) e, h . Analogously, because agent k 2{ } envies agent i0 at 0,Lemma7impliesthati0 gets at least h = '[ 0](k) at [ k⇤, 0 k].Hence '[ k⇤, 0 k](i0) e, h . By Claim 3(2), '[ k⇤, k](i0) e, h . Thus, 2{ } 2{ }

'[ k⇤, k](i),'[ k⇤, k](i0) = e, h . { } { }

This equality implies that to prove the claim it is enough to show that '[ k⇤, k](i)=h and '[ k⇤, k](i0)=e cannot both be true. Suppose they are. By Maskin monotonicity for i, '[ k⇤, k]='[ k⇤, i⇤, k,i ]. This equivalence and Claim 3(1) give '[ k⇤, i⇤, k,i { } { } ](k)=g. By strategy-proofness, agent k gets at least g and not e at [ i⇤, i]. By Claim 2(1), we must thus have '[ i⇤, i](k)=g. But this contradicts Claim 2(2). QED

Claim 5. (1) '[ k⇤, k]='[ k⇤, i⇤ , k,i ]='[ k⇤, i⇤ , j0 , k,i ,j ]. 0 { 0} 0 { 0 } (2) '[ k⇤, i⇤ 0 k,i ](k)=g. 0 { 0}

Proof of Claim 5. The ﬁrst equality of part (1) follows from Maskin monotonicity for i0 and

Claim 4. To prove the second equality of part (1), notice that at preference proﬁle ( k⇤, k) agent j does not get e or h (by Claim 4), and he does not get g by Claim 3(1). Thus the second equality follows from Maskin monotonicity for j. Now, part (2) of the claim follows from part (1) and Claim 3(1). QED

Claim 6. '[ i⇤ , 0 i ](i)=e. 0 0 Proof of Claim 6. Strategy-proofness for k and Claim 5(2) imply that agent k gets at least g at i⇤ , 0 i but does not get e. By Claim 2(1), k gets g at i⇤ , 0 i .Bynon-bossiness 0 0 0 0 for kand part (2) of Claim 5,

'[ i⇤ , 0 i ]='[ k⇤, i⇤ 0 k,i ]. 0 0 0 { 0}

This equality and part (1) of Claim 5 imply that

'[ i⇤ , 0 i ]='[ k⇤, k]. 0 0

This equation and Claim 4 give us '[ i⇤ , 0 i ](i)=e. QED 0 0

Claim 7. '[ i⇤ , 0 i ](i) = e. 0 0 6

Proof of Claim 7. Let us ﬁrst prove that '[ ⇤i,i , 0 i,i ](i) = h. Suppose not. Then, { 0} { 0} 6 Maskin monotonicity for i0 gives '[ i⇤, 0 i]='[ ⇤i,i , 0 i,i ], and in particular, '[ i⇤, 0 i { 0} { 0} 56 ](i)=h.Bystrategy-proofnessfori, '[ 0](i) i h, contradicting that '[ 0](i0)=e and ⌫ '[ 0](k)=h,andprovingtherequiredinequality. Since i pushes down the ranking of h in ⇤, the just-proven inequality and Maskin i monotonicity for i give:

'[ ⇤i,i , 0 i,i ]='[ i⇤ , 0 i ]. { 0} { 0} 0 0

Asymmetricargumentimpliesthat'[ ⇤i,i , i,i0 ](i0) = h and { 0} { } 6

'[ ⇤i,i , i,i0 ]='[ i⇤, i]. { 0} { }

Contrary to the claim we are proving, suppose that '[ i⇤ , 0 i ](i)=e. Then, the ﬁrst of 0 0 the above-displayed equalities implies '[ ⇤i,i , 0 i,i ](i)=e and, hence, j envies i under { 0} { 0} [ ⇤i,i , 0 i,i ]=[ ⇤i,i , i,i0,j , j0 ]. This, however, leads to a contradiction with Lemma { 0} { 0} { 0} { } 5, because Claim 2 and the second above-displayed equality implies that '[ ⇤i,i , i,i0,j { 0} { } , j](i)=h. Thus, we have shown that '[ i⇤ , 0 i ](i) = e. QED 0 0 6

The contradiction between Claims 6 and 7 shows that the initial assumption '[ ](i)= e = '[ 0](i) cannot be correct. QED 6

Lemma 10. (Existence and uniqueness of a broker* for each brokered* house)Let

and e be a brokered* house at .Thenthereexistsanagentk I who is the unique 2 M 2 broker* of e at .

Proof of Lemma 10. Let and e be a brokered* house at . We start with the 2 M following preparatory claim:

Claim 1. If h, h0 are two diﬀerent houses in H e ,and , 0 P[, e, h, h0],then'[ 0 { } 2 1 1 ] (h)='[ ] (h). 1 1 1 Proof of Claim 1. By Lemma 9,'[ 0] (e)='[ ] (e). Let i = '[ ] (e).Alsolet ⇤ and 0⇤ be monotonic transformations of and 0,respectively,suchthati ranks e ﬁrst, all agents in I rank e below all houses in H e ,andtherelativerankingsofall { } other houses under ⇤, and 0⇤, 0 are respectively the same. By Maskin monotonicity, '[ ⇤0]='[ 0] and '[ ⇤]='[ ].Also ⇤, 0⇤ P[ (i, e) ,h,h0]. Thus, by Lemma 2 [{ } 1 1 1 1 1 1 9, '[ ⇤] (h)='[ ⇤0] (h).Hence,'[ 0] (h)='[ 0⇤] (h)='[ ⇤] (h)='[ ] (h). QED

Claim 2. If h, h0 are two different houses in H e ,andprofiles P[, e, h] and 0 { } 2 2 1 1 1 1 P[, e, h0,h] are such that '[ 0] (e) = '[ ] (e),then'[ 0] (h0)='[ ] (h). 6 57 1 Proof of Claim 2. Let k0 = '[ 0] (h0) and ⇤ P[, e, h0,h] be such that the only difference 2 1 between ⇤ and is the relative ranking of house h0. Since by Claim 1 '[ ⇤] (h0)='[ 0 1 ] (h0)=k0 and since we lower house h0 in everybody’s preferences except k0 at [ k⇤ , k ], 0 0 by Maskin monotonicity

'[ k⇤ , k ]='[ ⇤]. 0 0

In particular, '[ k⇤ , k ](k0)=h0.Bystrategy-proofnessfork0, we have '[ ](k0) h, h0 . 0 0 2{ } On the other hand, by Lemma 9,

1 1 '[ ⇤] (e)='[ 0] (e).

1 1 The two above displayed equalities imply that '[ k⇤ , k ] (e)='[ 0] (e).Byassump- 0 0 1 1 1 tion of the claim, '[ ] (e) = '[ 0] (e)='[ k⇤ , k ] (e).Bynon-bossiness,agent 6 0 0 k0 changes his own allocation while switching between the two proﬁles and [ k⇤ , k ], 0 0 implying that '[ ](k0)=h. QED

Claim 3. If h, h0 are two diﬀerent houses in H e ,and P[, e, h], and 0 P[, e, h0,h], { } 2 2 1 1 then '[ ] (h)='[ 0] (h0).

1 1 Proof of Claim 3. If '[ ] (e) = '[ 0] (e), then Claim 3 reduces to Claim 2. Assume that 6 1 1 '[ ] (e)='[ 0] (e).Becausee is brokered* at ,thereexistssomeh00 H e such 2 { } that for some 00 P[, e, h00], 2

1 1 1 '[ 00] (e) = '[ ] (e)='[ 0] (e). 6

By Lemma 9, h00 = h.Bythesamelemma,weassumethat 00 P[, e, h00,h]. 6 2 1 1 1 1 By Claim 2, '[ 00] (h00)='[ ] (h) and '[ 00] (h00)='[ 0] (h0),implyingthat 1 1 '[ ] (h)='[ 0] (h0). QED

1 1 Claim 4. If h H e and , 0 P[, e, h],then'[ ] (h)='[ 0] (h). 2 { } 2

1 1 Proof of Claim 4. By Lemma 9, '[ ] (e)='[ 0] (e).Becausee is brokered* at ,there exists some h00 H e such that for some 00 P[, e, h00], 2 { } 2

1 1 1 '[ 00] (e) = '[ ] (e)='[ 0] (e). 6

By Lemma 9, h00 = h and, by the same lemma, we may assume 00 P[, e, h00,h]. By Claim 6 2 1 1 1 1 1 3, '[ 00] (h00)='[ ] (h) and '[ 00] (h00)='[ 0] (h),implyingthat'[ ] (h)='[ 0 1 ] (h). QED

58 To complete the proof of the lemma notice that e being brokered implies there is at least one house in H e .Leth and h0 H e , P[, e, h], 0 P[, e, h0].Ifh = h0, { } 2 { } 2 2 1 1 then '[ 0] (h)='[ ] (h) by Claim 4. Consider the case h = h0,andﬁx ⇤ P[, e, h, h0]. 6 2 1 1 1 1 By Claim 3, '[ 0] (h)='[ ⇤] (h0) and by Claim 4 '[ ⇤] (h)='[ ] (h), implying 1 1 1 that '[ ] (h)='[ 0] (h0). Thus, the agent '[ ] (h) is the unique broker* of e at . QED

Lemma 11. Let , i I, and h H. If '[ ](i)=h for all P⇤[, h],theni 2 M 2 2 2 owns* h at .

Proof of Lemma 11. Let us start with two preparatory claims:

Claim 1. Suppose ,housesg and h H are diﬀerent, and agent i I.If'[ 0](i)=h 2 M 2 2 for all 0 P[, h, g],then'[ i⇤, i](i)=g for all i⇤ g, ... and all i P i[, h]. 2 2h i 2

Proof of Claim 1. Let i P i[, h].Takeany i h, g, ... .If'[ ](i)=h,then 2 2h i Pareto efficiency and strategy-proofness imply that '[ i⇤, i](i)=g for all i⇤ g, h, ... , 2h i and furthermore, by strategy-proofness, for all ⇤ g, ... .Itremainstoconsiderthecase i 2h i '[ ](i) = h. 6 Take 0 P[, h, g] such that 0 and coincide other than at unmatched agents’ ranking 2 of house g.Wehave'[ 0](i)=h by the hypothesis of the claim. Two cases are possible: '[ ](i)=g and '[ ](i) = g.If'[ ](i)=g,thenbystrategy-proofness,'[ i⇤, i](i)=g 6 and we are done. Thus, in the remainder assume that there exists some agent k = '[ 1 ] (g) = i. By Maskin monotonicity, '[ 0 i,k , i,k ](i)=h and '[ 0 i,k , i,k ](k)=g. 6 { } { } { } { } Let i⇤ g, h, ... .Bystrategy-proofness,agenti gets at least h at [ i⇤, k0 , i,k ]; and 2h i { } by Pareto efficiency, agent i gets g.Alsorecallthat'[ ](i) i g and '[ ](k)=g. Thus, '[ i⇤, k0 , i,k ](k) = h because otherwise agents i and k could jointly improve upon their { } 6 '[ ] allocation by submitting [ ⇤, 0 ] at , contradicting group strategy-proofness. Thus, i k g k0 '[ i⇤, k0 , i,k ](k), and furthermore, Maskin monotonicity implies '[ i⇤, k0 , i,k { } { } ]='[ i⇤, i].Inparticular,'[ i⇤, i](i)=g. QED 1 Claim 2. Suppose ,housesg and h H are different, and '[ 0] (h)=i I for 2 M 2 2 all 0 P[, h, g].If P[, h] and there is some 0 P[, h, g] such that k h, g, ... for 2 2 2 2h i 1 k = '[ 0] (g),then'[ ](i)=h. 1 Proof of Claim 2. Assume that '[ 00] (h)=i I for all 0 P[, h, g].Bywayof 2 2 contradiction suppose P[, h] and there is some 0 P[, h, g] such that k h, g, ... 2 2 2h i 59 1 for k = '[ 0] (g),andyet'[ ](i) = h.Bystrategy-proofness,wecanchoose i h, g, ... . 6 2h i Furthermore, we can choose such that and 0 differ only in the preferences of a single agent j I and in how house g is ranked by the agents. 2 Let ⇤ P[, h] be the unique profile, such that ⇤ and differ only in the preferences of 2 agent j, and ⇤ and 0 differ only in how house g is ranked by the agents. Notice that j = k 6 as otherwise Maskin monotonicity would imply that i gets h at . Thus, ⇤ h, g, ... , and k2h i Maskin monotonicity implies that '[ ⇤](i)=h. Let h0 be the house that j gets at and let 00 be the unique profile in P[, h, g] such that 00 and differ only in how house g is ranked by agents. By Maskin monotonicity, we may assume that 00 h, g, h0,... . j 2h i By Claim 1 and strategy-proofness, '[ j00, j](i) equals either h or g.Atthesame time, strategy-proofness implies that '[ j00, j](j) equals either g or h0.Ineithercase, agent j prefers the allocation of agent i at [ j00, j].If'[ j00, j](i)=g,thiswouldbea contradiction with Lemma 3, as j could improve the allocation of i by switching from [ 00 j , j] to [ j⇤, j]= ⇤.Hence,'[ j00, j](i)=h,andbynon-bossiness'[ j00, j](j)=g. However, k = j gets g at 0 and by strategy-proofness j cannot get it at [ j00, 0 j]. This is 6 acontradictionbecause[ j00, j]=[ j00, 0 j]. QED We are ready to finish the proof of the lemma. Fix .Weproceedbywayof 2 M contradiction. Let i I be such that '[ 0](i)=h for all 0 P⇤[, h]. Let P[, h] be 2 2 2 1 g such that '[ ] (h)=j = i.Forallunmatchedhousesg = h at , define to be the 6 6 unique profile in P[, h, g] that differs from only in how agents rank g. g1 Take a house g1 = h unmatched at , and let k1 be the agent that gets g1 at .By 6 Claim 2, agent i gets h at any profile in P[, h] at which k1 ranks g1 second. Hence, by

Maskin monotonicity, i also gets h at any proﬁle in P[, h] at which k1 gets g1.

g2 Let g2 = '[ ](k1) and let k2 be the agent that gets g2 at .Becausei does not get h at ,thepreviousparagraphyieldsg2 = g1 and k2 = k1.Asinthepreviousparagraph, 6 6 Claim 2 and Maskin monotonicity imply that i gets h at any proﬁle in P[, h] at which k2 gets g2 or ranks g2 second.

Furthermore, we will show that i gets h at any proﬁle 0 P[, h] at which k2 ranks g1 2 second. Indeed, suppose 0 h, g1,... and i does not get h at 0.Let 00 h, g1,... .By k2 2h i i 2h i Claim 1 and strategy-proofness, agent i gets g1 at [ i00, 0 i].Bythepreviousparagraphand strategy-proofness, k2 does not get h at [ i00, 0 i],andthusk2 envies i at [ i00, 0 i].However, by the previous paragraph k2 can improve the outcome of agent i,contrarytoLemma5.

Thus, i gets h at any proﬁle in P[, h] at which k2 ranks g1 second.

g3 Let g3 be the house that k2 gets at and let k3 be the agent that gets g3 at .As above, we can show that i gets h at any proﬁle in P[, h] at which k3 ranks g3 or g2 or g1

60 second. Since the number of agents is ﬁnite, by repeating the procedure we arrive at an agent kn who ranks one of the houses g1,...,gn second at . That means that i gets h at ,a contradiction that concludes the proof. QED

Lemmas 10 and 11 and the deﬁnitions of owned* and brokered* houses give us the key result of this subsection:

Proposition 3. (Houses are either brokered* or owned*)Forany ,anyhouse 2 M h H is owned* or brokered* at ,butnotboth.Inparticular,ifthereisonlyoneagent 2 who owns* houses at then h is not a brokered* house.

Although the starred control rights do not allow having a broker* when there is a single owner*, R1-R6 do not eliminate this possibility from consistent control rights structures. However, it turns out that for any control rights obeying R1-R6, it is trivial to construct an equivalent one in which control rights are set equal to the original ones at all submatchings except possibly submatchings with single owners, where all houses are now owned by this original owner. In particular, if there is a broker in a submatching with a single owner in the original control rights structure, then in the superior submatching that matches the owner with the originally brokered house, the new control rights are set such that the original broker owns the remaining houses.

F.2 The Starred Control Rights Structure Satisﬁes R1-R6

Before proving R1-R6 let us state and prove one more auxiliary result.

Lemma 12. (Relationship between brokerage* and ownership*). Let ,agent 2 M 1 k be a broker* of house e at , and 00 P⇤[, e].Thenagent'[ 00] (e) is the owner* of 2 house '[ 00](k) at .

Proof of Lemma 12. Let 00 P⇤[, e] and h = '[ 00](k).Becausek is a broker* at , 2 Lemma 10 implies that house h is agent k’s second choice. Since 00 P⇤[, e],househ is 2 the second choice of all agents in I at 00,andthus,

00 P[, e, h]. 2

1 There exists an agent i (I) k such that '[ 00] (e)=i.ByLemma9,forall 2 { } P[, e, h], agent i gets e at .Wearetoshowthati is the owner* of h at . 2 Claim 1. If P[, e, h], then '[ ](i)=e and '[ ](k)=h. 2 61 Proof of Claim 1. The ﬁrst claim follows from Lemma 9, and the second from Lemma 10. QED

Claim 2. '[ ](i)=e and '[ ](k)=h.

Proof of Claim 2. Let preference proﬁle be such that i = 00 for all i0 k, i I and 0 i0 2{ }[ all houses in H are ranked above the houses in H for all i0 I. By Claim 1 and Maskin 2 monotonicity, '[ ](i)=e and '[ ](k)=h. QED.

Claim 3. '[ i⇤, i](i)=h.

Proof of Claim 3. Let ⇤ h, e, .... .Bythestrategy-proofnessof', since '[ ](i)=e, i 2h i agent i gets at least e at [ i⇤, i],andsinceallotheragentsinI prefer e over h,thePareto eﬃciency of ' implies that '[ i⇤, i](i)=h.

Claim 4. '[ k⇤, k]='[ ].

Proof of Claim 4. Let k⇤ h, e, .... .Since'[ ](k)=h,proﬁle[ k⇤, k] is a monotonic 2h i transformation of and by the Maskin monotonicity of ',wehave'[ k⇤, k]='[ ].

Claim 5. '[ ⇤i,k , i,k ](i)=h. { } { }

Proof of Claim 5. By Claim 4, '[ k⇤, k](i)='[ ](i)=e,and,bythestrategy-proofness of ', i gets at least e at [ ⇤i,k , i,k ]. Thus, if i does not get h at [ ⇤i,k , i,k ] then one { } { } { } { } of the following two cases would have to obtain.

Case 1. An agent j i, k gets h at [ ⇤i,k , i,k ]: Then i gets e,andk gets some 62 { } { } { } house worse than e. But then jointly i and k can report i,k instead of ⇤i,k and they { } { } would jointly improve at ⇤i,k ,i.e.,'[ ](i)=e = '[ i,k⇤ , i,k](i) and '[ ](k)=h k⇤ { } '[ i,k⇤ , i,k](k),contradictingthefactthat' is group strategy-proof. Case 2. Agent k gets h at [ i,k⇤ , i,k]:Bythestrategy-proofnessof',agentk should at least get h at [ i⇤, i].ButweknowbyStep2that'[ i⇤, i](i)=h,andthusweshould have '[ i⇤, i](k)=e. Then by the Maskin monotonicity of ',wehave'[ i,k⇤ , i,k](i)= '[ i⇤, i](i)=h where the last equality follows by Step 2, a contradiction that proves the claim. QED

Claim 6. If '[ ⇤i,k , i,k ](i)=h, then '[ ⇤i,k , i,k ](k) = e. { } { } { } { } 6

Proof of Claim 6. For an indirect argument, suppose that '[ ⇤i,k , i,k ](i)=h and { } { } '[ ⇤i,k , i,k ](k)=e. Then, '[ i⇤, i](k)=e by the strategy-proofness of '. Since e { } { } is a brokered* house at ,thereexistssomehouseg e, h and some preference proﬁle 62 { } 62 1 0 P[, e, g] such that '[ 0] (e)=j for some agent j i, k .ByLemma9,wemay 2 62 { } assume that each agent i0 I ranks houses other than g and h in the same way at 0 and 2 i0 i and that 0 e, g, h, ... .Sincek is the broker* of e at ,wehave'[ 0](k)=g.By 0 i0 2h i Maskin monotonicity,

'[ 0]='[ 0 i,k , i,k ]. { } { }

Now i gets a house weakly worse than h at [ 0 i,k , i,k ].However,ifi and k manipulated { } { } and submitted ⇤i,k instead of 0 i,k ,theywouldgeth and e respectively at [ ⇤i,k , i,k ]. { } { } { } { } Both agents weakly improve, while k strictly improves. This contradicts the fact that ' is group strategy-proof. QED

Now, Claims 5 and 6 imply that '[ ⇤i,k , i,k ](i)=h and '[ ⇤i,k , i,k ](k) = e.By { } { } { } { } 6 Maskin monotonicity, we can drop the ranking of e in ⇤ and ⇤,andyet,theoutcomeof i k ' will not change. Recall that i,k was an arbitrary proﬁle in which all houses in H are { } ranked above the houses in H by i0 I i, k . Thus, i gets h at all proﬁles of P[, h]. 2 { } QED

The following six lemmas show that the starred control rights structure satisﬁes R1-R6 (respectively).

Lemma 13. (R1; Uniqueness of a brokered* house). Let .Ife is a brokered* 2 M house at ,thennootherhouseisabrokered*houseat (and all other unmatched houses are owned* houses).

Proof of Lemma 13. Let e be a brokered* house at .ByLemma10,thereisabroker* of e at ;letusdenotehimask. Consider a house h I e .ByLemma9,thereisan 2 { } agent i who gets e at all proﬁles in P[, e, h].ByLemma11,i is the owner* of h. Thus h is not a brokered* house at . QED

Lemma 14. (R2; Last unmatched agent is an owner). Let ,suchthatthere 2 M exists a unique agent i unmatched at .Theni owns* all unmatched houses at I. 2

Proof of Lemma 14. Let P[, h] for h H.ByParetoeﬃciencyof', '[ ](i)=h, 2 2 implying that i owns* h at . QED

Lemma 15. (R3; Broker* does not own*). Let .Ifagentk is the broker* of 2 M house e at ,thenhecannotown*anyhousesat.

63 Proof of Lemma 15. Suppose that k owns* a house h = e at .ByLemma9,thereexists 6 some agent i = k who gets e at all proﬁles in P[, e, h]. Thus, i gets h at all P⇤[, h], 6 2 contradicting the fact that k owns* h. QED

Lemma 16. (R4; Persistence of ownership*). Let i own* h at some .If 2 M 0 ) ,and i and h are unmatched at 0,theni owns* h at 0.

Proof of Lemma 16. Imagine to the contrary that i gets h at all P[, h],butthere 2 is some 0 P[0,h] such that some agent j I I,suchthatj = i, gets h at 0.Take 2 2 0 6 P[, h] such that 2

for each agent k I I, k= 0 , and • 62 0 k

each agent k I I ranks 0(k) as his second choice (just behind h)in k . • 2 0

Each k I I is indiﬀerent between 0 and because: 2 0

at 0 agent k gets 0(k) by Lemma 8, •

at agent k gets 0(k) by the Pareto eﬃciency of ' and the fact that '[ ](i)=h. •

The only difference between the profiles 0 and are the preferences of the agents in I I. 0 Thus, agents I I are indifferent between and 0, while agent j is strictly better offat 0 0. This contradicts the fact that ' is group strategy-proof. QED

Lemma 17. (R5; Limited persistence of brokerage*) Let ,0 be such that 2 M 0 ) .Supposethatagentk is the broker* of house e at ,agenti is the owner* of house h at ,andagenti0 = i is the owner* of house h0 at .Ifk, i, i0,e,h,h0 are unmatched at 6 0,thenk brokers* e at 0.

Proof of Lemma 17. First, notice that Lemma 12 implies that i gets e at all P[, e, h] 2 and i0 gets e at all P[, e, h0],andthatk gets h and h0, at the respective profiles. Take 2 h h0 P[, e, h] and P[, e, h0] such that each agent j I I has 0(j) as his third 2 2 2 0 choice and each agent j I I ranks each house unmatched at 0 above all houses matched 2 0 h h at 0 at both preference profiles. Let profile 0 be obtained from by moving 0(j) for h0 h0 all j I I up to be the first choice of j.Let 0 be obtained analogously from .By 2 0 h 1 h 1 h h Maskin monotonicity, '[ 0 ] (e)=i = i0 = '[ 0 0 ] (e).Since 0 and 0 0 P⇤[0,e], 6 2 house e is a brokered* house at 0. For an indirect argument for the second part of the proof, suppose that k is not the broker* of e at 0. Then, by Lemma 10 there exists some other agent k0 = k who brokers* e 6 at 0.

64 Let 0 P[0,e,h] be arbitrary and P[, e, h] be such that each agent j in I I 2 2 0 lists 0(j) as his third choice at , each agent in I I lists houses in H lower than houses 0 0 in H H at ,andtherestoftherelativerankingsofthehousesarethesamebetween 0 and 0.Sincek brokers* e at and i owns* h at ,byLemma12'[ ](k)=g and '[ ](i)=e. Then, by Pareto eﬃciency, '[ 0](j)=0(j) for all j I I,andthus,by 2 0 Maskin monotonicity, '[ 0]='[ ]. Now, '[ 0](k)=h, however, this contradicts the fact that agent k0 = k brokers* e at 0 and thus, '[ 0](k0)=h. Therefore, k brokers* e at 0,as 6 well. QED

Lemma 18. (R6; Consolation for lost control rights*) Let , i, j I,and 2 M 2 g, h H be such that i = j and g = h, i controls* h at ,andj controls* g at .Theni 2 6 6 owns* g at 0 = (j, h) . [{ } Proof of Lemma 18. First consider the case i brokers* h and j owns* g at .ByLemmas11 and 12 and Maskin monotonicity, for all profiles P[] such that i h, g, ... , j h, ... , 2 2h i 2h i we have '[ ](i)=g and '[ ](j)=h. Then, by Maskin monotonicity, for any 0 P[0,g], 2 '[ ](i)=g,i.e.,i owns* g at 0. Next consider the case i owns* h and j owns* g at . For all profiles P[] such that 2 i g, h... and j h, g, ... ,strategy-proofnessfori implies '[ ](i) i h as '[ i0 , i 2h i 2h i ⌫ ](i)=h for 0 h, ... .Similarly,'[ ](j) j g.Paretoefficiencyimplies'[ ](i)=g and i2h i ⌫ '[ ](j)=h. Hence, by Maskin monotonicity, for all 00 P[0,g], '[ 00](i)=g,i.e.,iowns* 2 g at 0. Finally consider the case where i owns* h and j brokers* g at . By Lemmas 11 and 12 and Maskin monotonicity, for all profiles P[] such that i g, ... and j g, h... , 2 2h i 2h i we have '[ ](i)=g and '[ ](j)=h. Then, by Maskin monotonicity, for any 0 P[0,g], 2 '[ ](i)=g,i.e.,i owns* g at 0. QED

Lemma 19. (R6; Brokered*-to-Owned* House Transition) Let , k, j, i I, 2 M 2 and e, g, h H be such that k = j and e = g, k brokers* e at but not at 0 = (j, g) , 2 6 6 [{ } and i owns* h at .Theni owns* e at 0.

Proof of Lemma 19. By Lemmas 11 and 12 and Maskin monotonicity, for all proﬁles

P[] such that i e, ... and k e, h, ... ,wehave'[ ](i)=e and '[ ](k)=h. 2 2h i 2h i Since P[0] P[], Proposition 3 implies that either i owns* e at 0 or k brokers* e at 0. ⇢ The latter is not true, by an assumption made in the lemma; hence i owns* e at 0. QED

65 F.3 The TC Mechanism Deﬁned by the Starred Control Rights Structure Equals '

We showed above that the starred control rights structure (c, b) is well defined and consistent (satisfies R1-R6). We will now close the proof of Theorem 2 by showing that the resulting TC mechanism, c,b,mapspreferencestooutcomesinthesamewayas' does. Fix P. We will show that '[ ]= c,b[ ] proceeding by induction on the rounds of 2 c,b.LetIr be the set of agents removed in round r of c,b.Foreachagenti Ir,thereis 2 auniquehousethatpointstohimandisremovedinthesamecycleasi;letusdenotethis house by hi. Let us construct the following preference profile ⇤ by modifying . c,b If [ ](i)=hi,then ⇤= i. • i c,b If [ ](i) = hi and if no brokered house was removed in the same cycle as i or the • 6 brokered house was assigned to i,thenweconstruct ⇤ from i by moving hi just i after c,b[ ](i) (we do not change the ranking of other houses). If i is removed as owner and a brokered house er was removed in the same cycle as i • r c,b but not assigned to i,thenweconstruct ⇤ from i by moving e just after [ ](i) i r and moving hi just after e .

If a broker kr was removed in a cycle •

1 2 n r r h 1 i h 2 i ...h n i e k h 1 , i ! ! i ! ! i ! ! ! ! i

then we construct ⇤r from kr by moving hin just below h 1 . k i We will show that

c,b s '[ ⇤](i)= [ ⇤](i) i s rI , r =0, 1, 2,... (1) 8 2[ 8 by induction over the round r of c,b. The claim is trivially true for r =0.Fixroundr 1 r 1 0 and let be the matching ﬁxed before round r (in particular, = ?). For the inductive step, assume that

c,b s '[ ⇤](i)= [ ⇤](i) i s r 1I = Ir 1 8 2[

We will prove that the same expression holds for agents in Ir using the following three claims.

r Claim 1. '[ ⇤](i) ⇤ hi for all owners i I . ⌫i 2 66 r 1 Proof of Claim 1. Let 0 P[ ,hi] be a preference proﬁle such that the relative ranking 2 of all houses in H H r 1 hi in 0 is the same as in ⇤ for all j (I I r 1 ) i , { } j j 2 {} r 1 and let 00 P[ ] be a preference proﬁle such that the relative ranking of all houses in 2 H H r 1 in 00 is the same as in ⇤ for all j (I I r 1 ) i . j j 2 {} By Maskin monotonicity,

'[ ⇤]='[ (00I I r 1 ) i , I0 r 1 , i⇤]. { }

r 1 c,b Furthermore, by deﬁnition hi is owned by i at under and the construction of the control rights structure (c, b) from ' means that hi is owned* by i in '. Thus,

'[ 0](i)=h , i and no agent j (I I r 1 ) i gets hi at '[ 0]. These agents also do not get houses from 2 { } H r 1 at '[ 0]. Maskin monotonicity thus implies that

'[ 0]='[ (00I I r 1 ) i , I0 r 1 i ]. { } [{ }

Taken together the ﬁrst above-displayed equation, the strategy-proofness of ',andthethird and second above-displayed equations give us

'[ ⇤](i)='[ (00I I r 1 ) i , I0 r 1 , i⇤](i) i⇤ '[ (00I I r 1 ) i , I0 r 1 i ](i)='[ 0](i)=hi. { } ⌫ { } [{ }

QED

r Claim 2. If i I and no brokered house was removed in the cycle of i,then'[ ⇤](i)= 2 c,b [ ⇤](i).

c,b Proof of Claim 2. The inductive assumption implies that all houses better than [ ⇤](i) are already given to other agents; hence

c,b [ ⇤](i) ⇤ '[ ⇤](i). ⌫i

c,b For an indirect argument, suppose '[ ⇤](i) = [ ⇤](i). Then, Claim 1 and the construc- 6 tion of ⇤ imply that '[ ⇤](i)=h . i Let 2 n h i h 2 i ... h n i h i ! ! i ! ! ! i ! ! i

67 c,b be the cycle in which i is removed under [ ⇤].From

c,b n '[ ⇤](i)=h = [ ⇤](i ), i

n c,b n we conclude that '[ ⇤](i ) = [ ⇤](i ), and Claim 1 and the construction of ⇤ imply 6 that n c,b n 1 '[ ⇤](i )=h n = [ ⇤](i ). i As we continue iteratively, we obtain that

'[ ⇤](j)=h j

2 n c,b for all j i, i ,...,i .Hence,thematchingobtainedbyassigning [ ⇤](j) to each agent 2{ } 2 n 2 n j i, i ,...,i and '[ ⇤](j) to each agent j I i, i ,...,i Pareto dominates '[ ⇤] at 2{ } 2 { } ⇤,contradicting'[ ⇤] being Pareto eﬃcient. QED r Claim 3. If i I and a brokered house was removed in the cycle of i,then'[ ⇤](i)= 2 c,b [ ⇤](i). 0 r 1 Proof of Claim 3. Let e h 0 be the brokered house and k i be the broker at .Let ⌘ i ⌘

1 n h 1 i h 2 ... i e k h 1 i ! ! i ! ! ! ! ! i be the cycle in which they are removed in round r of c,b.Bytheinductiveassumption,for ` each i , ` =1,...,n,allhousesbetterthanhi`+1 are given to other agents before round r. Hence, Claim 1 implies that

` '[ ⇤](i ) h `+1 ,e,h ` ,`=1,...,n (2) 2{ i i }

Recall that h⇤`+1 ⇤` e ` h ` . We prove Claim 3 in two steps: i ⌫i i i n c,b n n Step 1. Let us show that '[ ⇤](i )=e = [ ⇤](i ). Suppose not. Then, '[ ⇤](i ) = e. 6 n Since e = h n+1 , the above displayed inclusion gives us '[ ⇤](i )=hin . Thus, the above i ` displayed inclusion tells us that '[ ⇤](i ) e, h ` for ` = n 1.Wecannothave'[ ⇤ 2{ i } ` n n 1 ](i )=e as it would not be Pareto efficient because agents i and i would be better off ` by swapping their allocations. Thus, '[ ⇤](i )=h ` .Iteratingthislastargumentweshow i that ` '[ ⇤](i )=h ` ,`= n, n 1,...,1. i r 1 r 1 Let us construct an auxiliary preference profile 0 P[ ] from ⇤ by pushing up (i) in 2 r 1 preferences of agents i I r 1 , pushing down houses matched at in preferences of agents 2 68 2 1 i I I r 1 , and pushing down h in preferences of i while preserving the relative ranking of 2 houses otherwise. By the above observations, 0 is a '-Maskin-monotone transformation of 1 1 r 1 ⇤,andhence'[ ⇤]='[ 0].Noticethatagenti owns* h at in ' and agent k brokers* r 1 c,b 1 1 e at in ' (by construction of in which i is the owner of h and agent k is the broker r 1 r 1 r 1 r 1 of e at ). Because 0 Pk[ ,h 1 ,...] Pk[ ,e,h 1 ,...],and 01 Pk[ ,e,h 1 ,...], k2 i [ i i 2 i 1 1 we get '[ 0](i )=e and thus '[ ⇤](i )=e contrary to the above displayed equations. This contradiction concludes Step 1. Step 2. Let us show that

` c,b ` '[ ⇤](i )=h `+1 = [ ⇤](i ) ` 0,...,n 1 . i 8 2{ }

` By way of contradiction, suppose there exists some ` 0,...,n 1 such that '[ ⇤](i ) = 2{ } 6 ` ` 1 h `+1 . Then, inclusion 2 and Step 1 imply that '[ ⇤](i )=h ` . Thus, '[ ⇤](i ) = h (` 1)+1 . i i 6 i Iterating this argument we show

m '[ ⇤](i )=h m m = ` 1,` 2,...,1. i

r 1 Let us construct an auxiliary preference proﬁle 0 P[ ] from ⇤ by pushing up 2 r 1 r 1 (i) in preferences of agents i I r 1 , pushing down houses matched at in preferences 2 1 0 of agents i I I r 1 , and pushing down h in preferences of i k while preserving the 2 ⌘ relative ranking of houses otherwise.

The above-displayed equations imply '[ ⇤](k) = h 1 ,andthus 0 is a '-Maskin-monotone 6 i n n r 1 transformation of ⇤,andhence'[ ⇤]='[ 0].Noticethatagenti owns* h at in ' r 1 c,b 1 1 and agent k brokers* e at in ' (by construction of in which i is the owner of h r 1 r 1 r 1 and agent k is the broker of e at ). Because 0 Pk[ ,hin ,...] Pk[ ,e,hin ,...], k2 [ r 1 and 01 Pk[ ,e,hin ,...],weget'[ 0](k)=hin and thus i 2

'[ ⇤](k)=h n . i

n 1 n 2 In consequence, inclusion 2 and Step 1 imply that '[ ⇤](i )=h n 1 . Thus, '[ ⇤](i ) = i 6 n 1 hi .Iteratingthisargumentweshow

m '[ ⇤](i )=h m m = n 1,n 2,...,1. i

The above-displayed equations and Step 1 imply that '[ ⇤] is Pareto dominated by the allocation in which each agent im, m =0,...,n 1,getshousehm+1,andallotheragentsget their '[ ⇤] houses. This contradiction concludes Step 2, and proves Claim 3. QED

69 c,b r Claims 2 and 3 show that '[ ⇤](i)= [ ⇤](i) for all i I . This completes the 2 inductive proof of equations (1). Now, the theorem follows from

c,b c,b c,b [ ]= [ ⇤], [ ⇤]='[ ⇤], and '[ ⇤]='[ ].

The ﬁrst of these equations follows directly from the construction of ⇤. The second equation is equivalent to equations (1). To prove the third equation, observe that for every agent i I, 2

c,b c,b h H : h [ ](i) = h H : h ⇤ [ ](i) . 8 2 ⌫i 9 8 2 ⌫i 9 <> = c,b[ ](i)='[ ]=> <> = c,b[ ](i)='[ ]=> ⇤ ⇤ ⇤ ⇤ > | {z } > > | {z } > In particular,: ; : ;

h H : h i '[ ⇤](i) = h H : h ⇤ '[ ⇤](i) for all i I, { 2 ⌫ } { 2 ⌫i } 2 and hence is a ' monotonic transformation of ⇤. The third equation thus follows from Maskin monotonicity of '. QED

GAppendix:ProofofTheorem3

The equivalence of the three pairs of incentive and eﬃciency conditions follows the same steps as in Theorem 1. Also, the argument for the Pareto eﬃciency of TC follows the same steps as in the case without outside options. As before, group strategy-proofness is equivalent to individual strategy-proofness and non-bossiness.

Lemma 20. In the environment with outside options, a mechanism is group strategy-proof if and only if it is individually strategy-proof and non-bossy.

The proof is analogous to the proof of Lemma 1 in Pápai (2000). Our arguments for individual strategy-proofness and non-bossiness go through with two modiﬁcations. First, when in the proof of Theorem 2 we assume that an agent is matched with a house, we should now substitute “matched with a house or the agent’s outside option.” If the agent is matched in a cycle of a length above 1, we can then conclude that the agent is indeed matched with a house. Second, in some steps of the proof we consider separately the case when a broker is matched with his outside option. We handle these cases below. This allows us to assume this case away in the relevant parts of the original proof.

70 Consider the proof of individual strategy-proofness. In Case 1: s s0,leti be a broker of  house e and suppose he leaves with his outside option in round s under i.Sincethesame houses are matched under i and 0 ,under 0 the best the broker can do is to leave either i i with his outside option, or—if he prefers the brokered house e to his outside option—to leave with the brokered house e.Weneedtoprovethatthelattercannothappen.ByLemma

4, in round s of TC under 0 ,agenti is a broker of e and there is an owner j whose first i preference is e.Fori to be matched with e,hewouldneedtolosethebrokerageright,butby R5-R6 if this happens then j becomes the owner of e, and is then matched with it, ending the argument for Case 1. In Case 2: s>s0,ifi be a broker of house e matched with his outside option under 0 ,thensubmittingthispreferenceprofilecannotbebetterthansubmitting i the true profile i,asunderanyprofileagenti is matched with at least his outside option. Consider the proof of non-bossiness. We run the same induction as in the proof without outside options. In the initial step of the induction, consider the additional case when i ⇤ is a broker and is matched with his outside option at time s under .Byassumptioni ⇤ is matched with his outside option under 0 and the inductive hypothesis is true. In the inductive step, consider the additional case in which i1 is a broker and is matched with his outside option at time r>sunder (handling this case separately allows us to assume this case away in all claims of the inductive step). By the inductive assumption, there is r 1 r r 1 1 an r⇤ such that [ ] ⇤ [ 0].At [ ], i brokers a house h and all houses other ✓ than h that i1 prefers to his outside option are matched. Since i1 gets at least his outside option, he either gets his outside option (and the inductive step is true) or he gets h.Inthe r 1 latter case, as in the proof of individual strategy-proofness, at [ ], there is an owner j whose top preference is h.Heremainsunmatchedaslongash is unmatched. Since for i1 to obtain h he would need to lose his brokerage right, conditions R5-R6 imply that j would get ownership over h, and would match with h.Hencei1 cannot be matched with h and is matched with his outside option. To prove that any group strategy-proof and efficient mechanism is a TC we follow the same steps as in the proof of Theorem 2 with one important modification. For , n 0 2 M 1 2 n 1 n and h ,h ,...,h H,andi I,weredefinePi[, h ,...,h ] to be the set of preferences i 2 2 of agent i such that

if i I, then • 2 (i) i g for all g H (i) , 2 { }

if i I, then • 2 1 2 n h i h ... i h i yi g for all g H. ⌫ ⌫ ⌫ 2

71 In particular, the deﬁnitions of ownership* and brokerage* are repeated word-by-word, but 1 n the meaning of Pi[, h ,...,h ] is changed as above. With this modiﬁcation, the proof goes through. QED‌

HProofofProposition2(LorenzDominance)

c⇤,b⇤ Let be the TC mechanism in which at the empty submatching i` owns h` for all ` = n 6 c,b and in brokers hn (the brokerage right is permanent). Let be any TTC mechanism satisfying the manager’s constraints, which implies that in does not own any objects as long as other agents are present and hn is unallocated. Let be the uniform lottery over proﬁles of preferences in which all agents rank objects in the same way, and for any mechanism [ ] [ ] let ⇢ (i, r) be the average of ⇢ (i, r) over the distribution . Since all agents share the same ranking under every realization of ,ineveryPareto eﬃcient mechanism we have

( ) ( ) ⇢ (i1,r)+... + ⇢ (in,r)=r. (3)

c⇤,b⇤ [ ] By symmetry among agents i1,...,in 1,thevalue⇢ (ik,r) is the same for all of them c⇤,b⇤ [ ] and for all r

c⇤,b⇤ [ ] k 1 c⇤,b⇤ [ ] c⇤,b⇤ [ ] min ⇢ (j, r)= r ⇢ (in,r) + ⇢ (in,r). J I, J =k n 1 ✓ | | j J X2 ⇣ ⌘

Let us denote this value by X⇤ (k). c,b Now, consider agent in and k 1 agents i1,...,in 1 with the lowest ⇢ ( ,r).By(3),the c,b · sum of ⇢ ( ,r) over these k agents is at most ·

c⇤,b⇤ [ ] c,b[ ] min ⇢ (j, r)+⇢ (in,r) J I in , J =k 1 ✓ { } | | j J X2 Let us denote this value by X (k).

To show that X⇤ (k) X (k) for all k notice that

k 1 c,b[ ] c,b[ ] X (k) r ⇢ (i ,r) + ⇢ (i ,r).  n 1 n n ⇣ ⌘ c⇤,b⇤ [ ] c,b[ ] It is thus enough to show that ⇢ (in,r) ⇢ (in,r). This inequality obtains because (i) in a TTC satisfying the manager’s constraints agent in cannot be allocated an object

72 before another agent takes hn or before in is the only unmatched agent remaining, and (ii) with any common ranking any TTC allocates one object per round, from the most preferred object down everybody’s list, and c⇤,b⇤ allocates objects in the same way in rounds preceding

c⇤,b⇤ the allocation of hn, and then in the round in which hn is allocated allocates to in his most preferred object among objects that remain.

To close the proof notice that for at least one k we must have X⇤ (k) >X(k).Indeed,if

X⇤ (1) = X (1) then in has the same ⇢·(in,r) at both mechanisms. Then, however, X⇤ (k) > X (k) for all k =2,...,n 1.Indeed,in c,b there is at least one agent who owns at least two c,b[ ] objects at the empty submatching. Such an agent i has ⇢ (i, r) strictly larger than the c⇤,b⇤ [ ] common value of ⇢ (i`,r) for ` =1,...,n 1.By(3),thesumoftherelevant⇢· ( ,r) · for the remaining n 2 agents is thus strictly less under c,b than under c⇤,b⇤ . QED

References

Abdulkadiroğlu, A., and Y.-K. Che (2010): “The Role of Priorities in Assigning Indi- visible Objects: A Characterization of Top Trading Cycles,” Working paper.

Abdulkadiroğlu, A., and T. Sönmez (1999): “House Allocation with Existing Tenants,” Journal of Economic Theory,88,233–260.

(2003): “School Choice: A Mechanism Design Approach,” American Economic Review,93,729–747.

Arrow, K. J. (1963): Social Choice and Individual Values.NewYork:Wiley,2ndedition edn.

Ashlagi, I., and A. E. Roth (2011): “Individual rationality and participation in large scale, multi-hospital kidney exchange,” Working paper.

Barberà, S., F. Gül, and E. Stacchetti (1993): “Generalized Median Voter Schemes and Committees,” Journal of Economic Theory,61,262–289.

Barberà, S., and M. O. Jackson (1995): “Strategy-proof Exchange,” Econometrica,63, 51–87.

Barberà, S., M. O. Jackson, and A. Neme (1997): “Strategy-proof Allotment Rules,” Games and Economic Behavior,18,1–21.

73 Bergson, A. (1938): “A Reformulation of Certain Aspects of Welfare Economics,” Quarterly Journal of Economics,52(2),310–334.

Blair, D., and E. Muller (1983): “Essential Aggregation Procedures on Restricted Do- mains of Preferences,” Journal of Economic Theory,30,34–53.

Bogolomania, A., and H. Moulin (2004): “Random Matching Under Dichotomous Pref- erences,” Econometrica,72,257–279.

Clarke, E. H. (1971): “Multipart Pricing of Public Goods,” Public Choice,11,17–33.

Dasgupta, P., P. Hammond, and E. Maskin (1979): “The Implementation of Social Choice Rules: Some General Results on Incentive Compatibility,” Review of Economic Studies,46,185–216.

Ehlers, L. (2002): “Coalitional Strategy-Proof House Allocation,” Journal of Economic Theory,105,298–317.

Ergin, H. (2000): “Consistency in House Allocation Problems,” Journal of Mathematical Economics,34,77–97.

(2002): “Eﬃcient Resource Allocation on the Basis of Priorities,” Econometrica,70, 2489–2498.

Gibbard, A. (1973): “Manipulation of Voting Schemes: A General Result,” Econometrica, 41, 587–601.

Green, J., and J.-J. Laffont (1977): “Characterization of Satisfactory Mechanisms for Revelation of Preferences for Public Goods,” Econometrica,45,427–438.

Groves, T. (1973): “Incentives in Teams,” Econometrica,41,617–631.

Hatfield, J. W. (2009): “Strategy-Proof, Eﬃcient, and Nonbossy Quota Allocations,” Social Choice and Welfare,33No.3,505–515.

Holmstrom, B. (1979): “Groves’ Scheme on Restricted Domains,” Econometrica,,47(5), 1137—1144.

Hylland, A., and R. Zeckhauser (1979): “The Eﬃcient Allocation of Individuals to Positions,” Journal of Political Economy,87,293–314.

Konishi, H., T. Quint, and J. Wako (2001): “On the Shapley-Scarf Economy: The Case of Multiple Types of Indivisible Goods,” Journal of Mathematical Economics,35,1–15.

74 Lorenz, M. O. (1905): “Methods of Measuring the Concentration of Wealth,” Publications of the American Statistical Association,9(70),209—219.

Ma, J. (1994): “Strategy-proofness and the strict core in a market with indivisibilities,” International Journal of Game Theory,23,75–83.

Maskin, E. (1999): “Nash Equilibrium and Welfare Optimality,” Review of Economic Stud- ies,66,23–38.

Moulin, H. (1988): Axioms of Cooperative Decision Making. Cambridge: Cambridge Uni- versity Press.

Pápai, S. (2000): “Strategyproof Assignment by Hierarchical Exchange,” Econometrica,68, 1403–1433.

(2007): “Exchange in a General Market with Indivisible Goods,” Journal of Eco- nomic Theory,132,208–235.

Pathak, P. A., and T. Sönmez (2008): “Leveling the Playing Field: Sincere and Sophis- ticated Players in the Boston Mechanism,” American Economic Review,98,1636–1652.

Rees, M. A., J. E. Kopke, R. P. Pelletier, D. L. Segev, M. E. Rutter, A. J. Fabrega, J. Rogers, O. G. Pankewycz, J. Hiller, A. E. Roth, T. Sandholm, M. U. Ünver, and R. A. Montgomery (2009): “A Non-simultaneous Extended Altru- istic Donor Chain,” The New England Journal of Medicine,360,1096–1101.

Roth, A. E. (1982): “Incentive Compatibility in a Market with Indivisibilities,” Economics Letters,9,127–132.

Roth, A. E., and A. Postlewaite (1977): “Weak Versus Strong Domination in a Market with Indivisible Goods,” Journal of Mathematical Economics,4,131–137.

Roth, A. E., T. Sönmez, and M. U. Ünver (2004): “Kidney Exchange,” Quarterly Journal of Economics,119,457–488.

Samuelson, P. A. (1947): Foundations of Economic Analysis. MA: Harvard University Press.

Satterthwaite, M. (1975): “Strategy-proofness and Arrow’s Conditions: Existence and Correspondence Theorems for Voting Procedures and Social Welfare Functions,” Journal of Economic Theory,10,187–216.

75 Satterthwaite, M., and H. Sonnenschein (1981): “Strategy-Proof Allocation Mecha- nisms at Diﬀerentiable Points,” Review of Economic Studies,48,587–597.

Sen, A. (1970): “Interpersonal Aggregation and Partial Comparability,” Econometrica, 38(3), 393–409.

(1999): “The Possibility of Social Choice,” American Economic Review,89(3),349– 378.

Shapley, L., and H. Scarf (1974): “On Cores and Indivisibility,” Journal of Mathematical Economics,1,23–37.

Sönmez, T., and M. U. Ünver (2006): “Kidney Exchange with Good Samaritan Donors: A Characterization,” Working paper.

(2010): “Market Design for Kidney Exchange,” Zvika Neeman, Muriel Niederle, and Nir Vulkan (eds.) Oxford Handbook of Market Design,forthcoming,OUP.

Svensson, L.-G. (1994): “Queue Allocation of Indivisible Goods,” Social Choice and Wel- fare,11,223–230.

(1999): “Strategy-proof Allocation of Indivisible Goods,” Social Choice and Welfare, 16, 557–567.

Takamiya, K. (2001): “Coalition Strategy-Proofness and Monotonicity in Shapley-Scarf Housing Markets,” Mathematical Social Sciences,41,201–213.

Vickrey, W. (1961): “Counterspeculation, Auctions and Competitive Sealed Tenders,” Journal of Finance,16,8–37.

Warmbir, S. (2003): “UIC Hospital Sued for Medicare Fraud,” Chicago Sun Times,July 29.

Zhou, L. (1991): “Ineﬃciency of Strategy-Proof Allocation Mechanisms in Pure Exchange Economies,” Social Choice and Welfare,8,247–257.